IPlocation command not working for all the IPs

[kranthimutyala]

Hi Team,

Im trying to get the user location based on the ip address in splunk but IPlocation command is failing to retrieve the city for few of the records.Below is the query im using .For some records splunk is  not pulling up city/region.Can someone pleas help .Thanks

index=vpn   host="*sin-bon-vpn*" Cisco_ASA_message_id=722051 OR Cisco_ASA_message_id=113019 NOT "AnyConnect-Parent" 
| transaction user endswith="Duration:" keepevicted=true
| mvexpand src 
|rename host as vpn
| iplocation src  |table lat lon user vpn City  Region

[richgalloway · Accepted solution]

The iplocation command uses a database supplied by MaxMind.  You can try updating the database with a newer release to see if it helps (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file), but keep in mind it is not perfect and many IP addresses will not have city or region information.