Splunk Enterprise Security

With Splunk Enterprise Security, I'm getting varying IP geo-location results when comparing Splunk to third-party resources — how frequent are Splunk geo cache updates?

crumblecat88
Engager

Hi,

I'm getting varied results in Splunk when I investigate an IP address' location. Splunk might say "Netherlands", while multiple third-party resources might say "Estonia."

With no evidence to say one is right over the other — how frequently does Splunk update their geo cache?

Thanks

0 Karma
1 Solution

pkeenan87
Communicator

The iplocation command uses a local .mmdb file to do the lookups, which you can update yourself.

  1. From http://dev.maxmind.com/geoip/geoip2/geolite2/, download the binary gzipped version of the GeoLite2 City database file.
  2. Copy the file to the search head on your Splunk Enterprise instance.
  3. Expand the GZ file.
  4. Stop any real-time searches that are running
  5. Copy the GeoLite2-City.mmdb file to the $SPLUNK_HOME/share/ directory to overwrite the file there.
  6. Restart the real-time searches.

For reference: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Iplocation

View solution in original post

pkeenan87
Communicator

The iplocation command uses a local .mmdb file to do the lookups, which you can update yourself.

  1. From http://dev.maxmind.com/geoip/geoip2/geolite2/, download the binary gzipped version of the GeoLite2 City database file.
  2. Copy the file to the search head on your Splunk Enterprise instance.
  3. Expand the GZ file.
  4. Stop any real-time searches that are running
  5. Copy the GeoLite2-City.mmdb file to the $SPLUNK_HOME/share/ directory to overwrite the file there.
  6. Restart the real-time searches.

For reference: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Iplocation

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...