Hi Team,
Im trying to get the user location based on the ip address in splunk but IPlocation command is failing to retrieve the city for few of the records.Below is the query im using .For some records splunk is not pulling up city/region.Can someone pleas help .Thanks
index=vpn host="*sin-bon-vpn*" Cisco_ASA_message_id=722051 OR Cisco_ASA_message_id=113019 NOT "AnyConnect-Parent"
| transaction user endswith="Duration:" keepevicted=true
| mvexpand src
|rename host as vpn
| iplocation src |table lat lon user vpn City Region
The iplocation command uses a database supplied by MaxMind. You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.
The iplocation command uses a database supplied by MaxMind. You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.