Splunk Enterprise Security

Longitude in DA-ESS-ThreatIntelligence is named as 'long' but the base search is 'lon'

christopherr_sp
Splunk Employee
Splunk Employee

There is a BUG in the DA-ESS-ThreatIntelligence app.

In the Datamodel under Threat Intelligence > IP Intelligence there is a field named “long” this field is supposed to hold the longitude of the IP address in the “ip” field.

Given the base search the field should be called “lon” because that is the field that the “iplocation” command outputs OR a rename should be done in the search to rename “lon” to “long”.

The problem found in DA-ESS-ThreatIntelligence 4.5.0 and above (all versions including the latest).

0 Karma
1 Solution

christopherr_sp
Splunk Employee
Splunk Employee

The following Bug had been logged with Product Management to clarify whether it was a Bug.

SOLNESS-19368 iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security

The response from Product Management (who confirmed it is not a Bug) is below:

CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".
So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.

View solution in original post

0 Karma

christopherr_sp
Splunk Employee
Splunk Employee

The following Bug had been logged with Product Management to clarify whether it was a Bug.

SOLNESS-19368 iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security

The response from Product Management (who confirmed it is not a Bug) is below:

CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".
So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...