Splunk Tile Maps

[leandromatperei]

How can I, from an IP, obtain its location to bring information by region? In the example below I only have the IP column, I need to bring information about the country and region of the same.

IP="189.80.213.213",Produto="Chuveiro Ducha Advanced Eletronica Turbo Lorenzetti",Valor="164,00",Categoria=Banho,Campanha="2",Vendeu="1",MetododeCompra="1",Bandeira="1",Transportadora="4",Frete="17,26",Time=2021/01/26 19:06:32.179"

IP="177.184.142.26",Produto="Crepeira Eletrica 4 Cavidades Antiaderente",Valor="99,90",Categoria=Cozinha,Campanha="2",Vendeu="1",MetododeCompra="1",Bandeira="1",Transportadora="1",Frete="10,24",Time=2021/01/26 19:06:31.579"

[manjunathmeti]

hi @leandromatperei,

Use iplocation command. It returns City, Country, lat, lon, and Region of the IPs.

| makeresults | eval ip="177.184.142.26" | iplocation ip

Check this page for more info: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Iplocation

If this reply helps you, an upvote/like would be appreciated.

[leandromatperei]

Hi @manjunathmeti,

Even using iplocation it does not bring me in many IP's the region and the city. Can you help me?

| makeresults | eval ip="200.223.134.86" | iplocation ip

https://tools.keycdn.com/geo?host=200.223.134.86 

[manjunathmeti · Accepted solution]

Splunk contains 3rd party database in $SPLUNK_HOME/share/. If you don't get data for country/regions for all your IPs. You may need to replace it.
Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Iplocation#Usage