Splunk Search

IPLocation: is there a state field?

Builder

Hello,

The iplocation command has the City and Country fields, for example:

sourcetype="IPS" | iplocation src_ip | table src_ip, City, Country

Is there a way or a field to add the State (or province?) to the results?

Thanks!

Tags (1)
0 Karma
1 Solution

Builder

Found it, the field is called "Region". This field should be included in the iplocation syntax documentation (that only mentions City and Country):

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Iplocation#Syntax

View solution in original post

0 Karma

Builder

Found it, the field is called "Region". This field should be included in the iplocation syntax documentation (that only mentions City and Country):

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Iplocation#Syntax

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!