Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Splunk Tile Maps
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I, from an IP, obtain its location to bring information by region? In the example below I only have the IP column, I need to bring information about the country and region of the same.
IP="189.80.213.213",Produto="Chuveiro Ducha Advanced Eletronica Turbo Lorenzetti",Valor="164,00",Categoria=Banho,Campanha="2",Vendeu="1",MetododeCompra="1",Bandeira="1",Transportadora="4",Frete="17,26",Time=2021/01/26 19:06:32.179"
IP="177.184.142.26",Produto="Crepeira Eletrica 4 Cavidades Antiaderente",Valor="99,90",Categoria=Cozinha,Campanha="2",Vendeu="1",MetododeCompra="1",Bandeira="1",Transportadora="1",Frete="10,24",Time=2021/01/26 19:06:31.579"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk contains 3rd party database in $SPLUNK_HOME/share/. If you don't get data for country/regions for all your IPs. You may need to replace it.
Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Iplocation#Usage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @leandromatperei,
Use iplocation command. It returns City, Country, lat, lon, and Region of the IPs.
| makeresults | eval ip="177.184.142.26" | iplocation ipCheck this page for more info: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Iplocation
If this reply helps you, an upvote/like would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @manjunathmeti,
| makeresults | eval ip="200.223.134.86" | iplocation ip
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk contains 3rd party database in $SPLUNK_HOME/share/. If you don't get data for country/regions for all your IPs. You may need to replace it.
Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Iplocation#Usage
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Community Badges!
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
