Splunk Search

Internet access for iplocation command

strive
Influencer

Hi,

We are using Splunk 5.0.4 extensively. We use maxmind to resolve Client IP to Country, City, Net Speed and ISP.

Now we are upgrading splunk to Splunk 6.0.1. As part of POC and some initial trials, i have installed Splunk 6.0.1 on my laptop.

Recently i came across iplocation command. I thought i will start using iplocation command and stop using maxmind. So, in my new Splunk installation i added a log file and wrote a simple search

index=main | iplocation allfields=true ClientIP | table *

Note: It is a fresh Splunk installation. While running these tests my laptop is not connected to internet

In my search results I am getting City, Country, lat, lon details. But, as per the links below, the iplocation command uses hostip.info api and it needs internet access.

http://answers.splunk.com/answers/49797/iplocation-and-counting-ips

http://answers.splunk.com/answers/5946/iplocation-command

http://answers.splunk.com/answers/45819/unknown-country-returned-by-iplocation-bug

http://answers.splunk.com/answers/37249/specifying-field-w-iplocation?page=1&focusedAnswerId=37370#3...

I am puzzled.

Could you please let me know:
whether iplocation command needs internet access to retrieve the results?
whether splunk has any in built geo database that is returning the geographic details?

Thanks

Strive

Tags (1)
1 Solution

Jason
Motivator

As of 6.0, iplocation transitioned away from a python script that went to the internet, to a fully-integrated Splunk command that uses a built-in database. (Likely maxmind, from the answer here: http://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command)

No internet access required, anymore.

View solution in original post

Jason
Motivator

As of 6.0, iplocation transitioned away from a python script that went to the internet, to a fully-integrated Splunk command that uses a built-in database. (Likely maxmind, from the answer here: http://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command)

No internet access required, anymore.

strive
Influencer

Yes splunk is using maxmind geo lite databases. These databases are updated for every minor release. Since maxmind databases get updated once every week (approximately) we have written python script which pulls the latest db files and replaces the older ones in our system.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...