Longitude in DA-ESS-ThreatIntelligence is named as 'long' but the base search is 'lon'

[christopherr_sp]

There is a BUG in the DA-ESS-ThreatIntelligence app.

In the Datamodel under Threat Intelligence > IP Intelligence there is a field named “long” this field is supposed to hold the longitude of the IP address in the “ip” field.

Given the base search the field should be called “lon” because that is the field that the “iplocation” command outputs OR a rename should be done in the search to rename “lon” to “long”.

The problem found in DA-ESS-ThreatIntelligence 4.5.0 and above (all versions including the latest).

[christopherr_sp · Accepted solution]

The following Bug had been logged with Product Management to clarify whether it was a Bug.

SOLNESS-19368 iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security

The response from Product Management (who confirmed it is not a Bug) is below:

CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".
So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.