With Splunk Enterprise Security, I'm getting varying IP geo-location results when comparing Splunk to third-party resources — how frequent are Splunk geo cache updates?

[crumblecat88]

Hi,

I'm getting varied results in Splunk when I investigate an IP address' location. Splunk might say "Netherlands", while multiple third-party resources might say "Estonia."

With no evidence to say one is right over the other — how frequently does Splunk update their geo cache?

Thanks

[pkeenan87 · Accepted solution]

The iplocation command uses a local .mmdb file to do the lookups, which you can update yourself.

1. From http://dev.maxmind.com/geoip/geoip2/geolite2/, download the binary gzipped version of the GeoLite2 City database file.
2. Copy the file to the search head on your Splunk Enterprise instance.
3. Expand the GZ file.
4. Stop any real-time searches that are running
5. Copy the GeoLite2-City.mmdb file to the $SPLUNK_HOME/share/ directory to overwrite the file there.
6. Restart the real-time searches.

For reference: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Iplocation