How accurate is iplocation for cluster map use?

[Gawker]

I have fortigate logs for which I have a high level of confidence that the srccountry values are correct.

I selected data from a particular day so that I could do my first cluster map using:

• | iplocation srcip | geostats latfield=lat longfield=lon count

I was seeing some data that looked on the surface to be invalid. iplocation was saying that one of the IPs was in Seychelles off of the coast of Africa while srccountry was correctly indicating that the IP was in the Netherlands.

I then determined the number of entries where iplocation Country did not match srccountry and removed the "where" clause to get the full count:

• | iplocation srcip | where NOT Country=srccountry | stats count

8,470 of the 29,233 data points (29%) had iplocation Country values that did not match srccountry.

561 of the 8,470 mismatches (7%) had null iplocation Country values.

Are my queries incorrect or...?

Thank you.

[starcher · Accepted solution]

By default Splunk uses the free Maxmind database. You are limited to that third party accuracy. Also if you are not updating your database that could be an issue.

• https://github.com/georgestarcher/TA-geoip
• http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Iplocation