Splunk Search

IPlocation command not working for all the IPs

kranthimutyala
Path Finder

Hi Team,

Im trying to get the user location based on the ip address in splunk but IPlocation command is failing to retrieve the city for few of the records.Below is the query im using .For some records splunk is  not pulling up city/region.Can someone pleas help .Thanks

 

index=vpn   host="*sin-bon-vpn*" Cisco_ASA_message_id=722051 OR Cisco_ASA_message_id=113019 NOT "AnyConnect-Parent" 
| transaction user endswith="Duration:" keepevicted=true
| mvexpand src 
|rename host as vpn
| iplocation src  |table lat lon user vpn City  Region

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The iplocation command uses a database supplied by MaxMind.  You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The iplocation command uses a database supplied by MaxMind.  You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...