Splunk Search

GeoLite IPLocation discrepancy

mbraiman
Explorer

Good Afternoon everyone!

We seem to be encountering a discrepancy with our IPLocation database. We're running Splunk 7.3.3 and recently updated the GeoLite lookup in /opt/splunk/share. We noticed a discrepancy however between what the MaxMind's mmdb file returns and what other online IP lookups show. The IP in question shows as a London/U.K based IP in online engines (including MaxMind's own lookup.) However Splunk's iplocation function labels it as an Italy-based address with appropriate Lat/Lon values. I'm at a loss as to what'd be causing this apparent mismatch. Any insight/experiences as to what's causing this problem are appreciated!

0 Karma
1 Solution

mbraiman
Explorer

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

View solution in original post

0 Karma

mbraiman
Explorer

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mbraiman,

Please provide some sample events that will result in the wrong location as well as the complete SPL used on these events, and the version of the MaxMind's mmdb file you used.

cheers, MuS

0 Karma

mbraiman
Explorer

Thanks for the reply MuS - I didn't realize that the mmdb file needed to be updated on each of our indexers as well as the search head. Once that was done the iplocation function mapped the events as we expected them. Thanks for your reply!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...