Splunk Search

Internet access for iplocation command

strive
Influencer

Hi,

We are using Splunk 5.0.4 extensively. We use maxmind to resolve Client IP to Country, City, Net Speed and ISP.

Now we are upgrading splunk to Splunk 6.0.1. As part of POC and some initial trials, i have installed Splunk 6.0.1 on my laptop.

Recently i came across iplocation command. I thought i will start using iplocation command and stop using maxmind. So, in my new Splunk installation i added a log file and wrote a simple search

index=main | iplocation allfields=true ClientIP | table *

Note: It is a fresh Splunk installation. While running these tests my laptop is not connected to internet

In my search results I am getting City, Country, lat, lon details. But, as per the links below, the iplocation command uses hostip.info api and it needs internet access.

http://answers.splunk.com/answers/49797/iplocation-and-counting-ips

http://answers.splunk.com/answers/5946/iplocation-command

http://answers.splunk.com/answers/45819/unknown-country-returned-by-iplocation-bug

http://answers.splunk.com/answers/37249/specifying-field-w-iplocation?page=1&focusedAnswerId=37370#3...

I am puzzled.

Could you please let me know:
whether iplocation command needs internet access to retrieve the results?
whether splunk has any in built geo database that is returning the geographic details?

Thanks

Strive

Tags (1)
1 Solution

Jason
Motivator

As of 6.0, iplocation transitioned away from a python script that went to the internet, to a fully-integrated Splunk command that uses a built-in database. (Likely maxmind, from the answer here: http://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command)

No internet access required, anymore.

View solution in original post

Jason
Motivator

As of 6.0, iplocation transitioned away from a python script that went to the internet, to a fully-integrated Splunk command that uses a built-in database. (Likely maxmind, from the answer here: http://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command)

No internet access required, anymore.

strive
Influencer

Yes splunk is using maxmind geo lite databases. These databases are updated for every minor release. Since maxmind databases get updated once every week (approximately) we have written python script which pulls the latest db files and replaces the older ones in our system.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...