Splunk Enterprise Security

Longitude in DA-ESS-ThreatIntelligence is named as 'long' but the base search is 'lon'

christopherr_sp
Splunk Employee
Splunk Employee

There is a BUG in the DA-ESS-ThreatIntelligence app.

In the Datamodel under Threat Intelligence > IP Intelligence there is a field named “long” this field is supposed to hold the longitude of the IP address in the “ip” field.

Given the base search the field should be called “lon” because that is the field that the “iplocation” command outputs OR a rename should be done in the search to rename “lon” to “long”.

The problem found in DA-ESS-ThreatIntelligence 4.5.0 and above (all versions including the latest).

0 Karma
1 Solution

christopherr_sp
Splunk Employee
Splunk Employee

The following Bug had been logged with Product Management to clarify whether it was a Bug.

SOLNESS-19368 iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security

The response from Product Management (who confirmed it is not a Bug) is below:

CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".
So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.

View solution in original post

0 Karma

christopherr_sp
Splunk Employee
Splunk Employee

The following Bug had been logged with Product Management to clarify whether it was a Bug.

SOLNESS-19368 iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security

The response from Product Management (who confirmed it is not a Bug) is below:

CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".
So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...