Is IPGeo location a built in feature of Splunk or is that an Add-on?

[Gregski11]

we upgraded our Splunk search heads from 8.x to 9.x and our customers report a discrepency in their IPGeo location searches, where version 8.x.x was reporting a different city for the same IP address as 9.x.x is reporting.

I thought ok, let me go upgrade the what ever IPGeo add-on app to the latest version (or to the same version on both Splunk servers) but I don't know what app I am looking for or if even that is a separate app or somehow part of the general Splunk code.

your feedback is greatly appreciated 

[richgalloway · Accepted solution]

The default geolocation database changes with every release.  The new database may produce different (hopefully more accurate) results than older versions.

You can update the database yourself, if it's in MMDB format.  See https://www.splunk.com/en_us/blog/tips-and-tricks/updating-the-iplocation-db and https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Iplocation for tips on that.

There is an app available to keep the database current.  See https://splunkbase.splunk.com/app/5482/ .

[Gregski11]

---

@richgalloway wrote:

The default geolocation database changes with every release.  The new database may produce different (hopefully more accurate) results than older versions.

You can update the database yourself, if it's in MMDB format.  See https://www.splunk.com/en_us/blog/tips-and-tricks/updating-the-iplocation-db and https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Iplocation for tips on that.

There is an app available to keep the database current.  See https://splunkbase.splunk.com/app/5482/ .

---

thank you so much Rich this really helps, it does appear as though the first two links you posted lead to the same location, was that what you expected?

https://www.splunk.com/en_us/blog/tips-and-tricks/updating-the-iplocation-db

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Iplocation

[richgalloway]

That was not the intent and I have fixed the links.  Thanks for pointing it out.