Hi all,
I have Splunk ESS Version: 7.1.3.
After updating the GeoLite2-City.mmdb db (last 17/3/20) I noticed that in my query the location is still wrong.
Example:
index=network eventtype=cisco_vpn_start "AnyConnect parent session started."
| where src_ip ="37.161.xx.xxx"
| iplocation src_ip
| table src_ip, Country
src_ip Country
37.161.xx.xxx France
However when I running the following command:
| makeresults
| eval ip="37.161.xx.xxx"
| iplocation ip
| table Country, ip
Country ip
Italy 37.161.xx.xxx
Why in one case is the correct value returned to me (Italy) while in the first case France appears to me?
The behavior is very anomalous to me 😞
Do you have any suggestion or fix for first query?
Thanks a lot,
Saverio
