Splunk Search

IPlocation command not working for all the IPs

kranthimutyala
Path Finder

Hi Team,

Im trying to get the user location based on the ip address in splunk but IPlocation command is failing to retrieve the city for few of the records.Below is the query im using .For some records splunk is  not pulling up city/region.Can someone pleas help .Thanks

 

index=vpn   host="*sin-bon-vpn*" Cisco_ASA_message_id=722051 OR Cisco_ASA_message_id=113019 NOT "AnyConnect-Parent" 
| transaction user endswith="Duration:" keepevicted=true
| mvexpand src 
|rename host as vpn
| iplocation src  |table lat lon user vpn City  Region

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The iplocation command uses a database supplied by MaxMind.  You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The iplocation command uses a database supplied by MaxMind.  You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...