GeoLite IPLocation discrepancy

[mbraiman]

Good Afternoon everyone!

We seem to be encountering a discrepancy with our IPLocation database. We're running Splunk 7.3.3 and recently updated the GeoLite lookup in /opt/splunk/share. We noticed a discrepancy however between what the MaxMind's mmdb file returns and what other online IP lookups show. The IP in question shows as a London/U.K based IP in online engines (including MaxMind's own lookup.) However Splunk's iplocation function labels it as an Italy-based address with appropriate Lat/Lon values. I'm at a loss as to what'd be causing this apparent mismatch. Any insight/experiences as to what's causing this problem are appreciated!

[mbraiman · Accepted solution]

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

[MuS]

Hi mbraiman,

Please provide some sample events that will result in the wrong location as well as the complete SPL used on these events, and the version of the MaxMind's mmdb file you used.

cheers, MuS

[mbraiman]

Thanks for the reply MuS - I didn't realize that the mmdb file needed to be updated on each of our indexers as well as the search head. Once that was done the iplocation function mapped the events as we expected them. Thanks for your reply!