Hello,
I am trying to use iplocation to search for instances of a specific city or region for example:
* iplocation ipaddress Region="region"
Instead of returning that specific region it will return all regions. Can anyone tell me if this is a bug or am I missing something?
Thanks
The iplocation command does not have a region option.
iplocation [prefix=<string>] [allfields=<bool>] [lang=<string>] <ip-address-fieldname>
See https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Iplocation
Hi thank you for your reply!
Ahh I see. From my understanding the documentation displays a region field with a prefix iploc_ to help distinguish from other fields that might already be present with the same name.
In my case I don’t have a previous region field so I don’t use the prefix query. Could you provide more insight as to why a prefixed field might be displayed if not supported? (i.e. I have tried doing this with iploc_Region as well)
Any help is much appreciated!