Splunk Search

GeoLite IPLocation discrepancy

mbraiman
Explorer

Good Afternoon everyone!

We seem to be encountering a discrepancy with our IPLocation database. We're running Splunk 7.3.3 and recently updated the GeoLite lookup in /opt/splunk/share. We noticed a discrepancy however between what the MaxMind's mmdb file returns and what other online IP lookups show. The IP in question shows as a London/U.K based IP in online engines (including MaxMind's own lookup.) However Splunk's iplocation function labels it as an Italy-based address with appropriate Lat/Lon values. I'm at a loss as to what'd be causing this apparent mismatch. Any insight/experiences as to what's causing this problem are appreciated!

0 Karma
1 Solution

mbraiman
Explorer

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

View solution in original post

0 Karma

mbraiman
Explorer

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mbraiman,

Please provide some sample events that will result in the wrong location as well as the complete SPL used on these events, and the version of the MaxMind's mmdb file you used.

cheers, MuS

0 Karma

mbraiman
Explorer

Thanks for the reply MuS - I didn't realize that the mmdb file needed to be updated on each of our indexers as well as the search head. Once that was done the iplocation function mapped the events as we expected them. Thanks for your reply!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...