Splunk Search

GeoLite IPLocation discrepancy

mbraiman
Explorer

Good Afternoon everyone!

We seem to be encountering a discrepancy with our IPLocation database. We're running Splunk 7.3.3 and recently updated the GeoLite lookup in /opt/splunk/share. We noticed a discrepancy however between what the MaxMind's mmdb file returns and what other online IP lookups show. The IP in question shows as a London/U.K based IP in online engines (including MaxMind's own lookup.) However Splunk's iplocation function labels it as an Italy-based address with appropriate Lat/Lon values. I'm at a loss as to what'd be causing this apparent mismatch. Any insight/experiences as to what's causing this problem are appreciated!

0 Karma
1 Solution

mbraiman
Explorer

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

View solution in original post

0 Karma

mbraiman
Explorer

Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mbraiman,

Please provide some sample events that will result in the wrong location as well as the complete SPL used on these events, and the version of the MaxMind's mmdb file you used.

cheers, MuS

0 Karma

mbraiman
Explorer

Thanks for the reply MuS - I didn't realize that the mmdb file needed to be updated on each of our indexers as well as the search head. Once that was done the iplocation function mapped the events as we expected them. Thanks for your reply!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...