Splunk Search

Can't get iplocation to work in my search

hmrabet2
Observer

I am not getting iplocation working in this query:

tag= web | stats count by IP, sessionId | stats dc(IP) as count, values(IP) as clientIP by sessionId | where count> 5 | iplocation clientIP

I can see the country, city, region fields appear but they are not populated

But when I run the following search I get IP location working with the country, region etc fields populated.

tag= web | iplocation IP | table IP, Country
0 Karma
1 Solution

hortonew
Builder

Add a | mvexpand clientIP after your stats command and it should work. I don't believe iplocation works on multivalue fields

View solution in original post

hortonew
Builder

Add a | mvexpand clientIP after your stats command and it should work. I don't believe iplocation works on multivalue fields

hmrabet2
Observer

Thanks that's done the trick

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...