Splunk Search
Highlighted

Can't get iplocation to work in my search

New Member

I am not getting iplocation working in this query:

tag= web | stats count by IP, sessionId | stats dc(IP) as count, values(IP) as clientIP by sessionId | where count> 5 | iplocation clientIP

I can see the country, city, region fields appear but they are not populated

But when I run the following search I get IP location working with the country, region etc fields populated.

tag= web | iplocation IP | table IP, Country
0 Karma
Highlighted

Re: Can't get iplocation to work in my search

Builder

Add a | mvexpand clientIP after your stats command and it should work. I don't believe iplocation works on multivalue fields

View solution in original post

Highlighted

Re: Can't get iplocation to work in my search

New Member

Thanks that's done the trick

0 Karma
Highlighted

Re: Can't get iplocation to work in my search

SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.