Internet access for iplocation command

[strive]

Hi,

We are using Splunk 5.0.4 extensively. We use maxmind to resolve Client IP to Country, City, Net Speed and ISP.

Now we are upgrading splunk to Splunk 6.0.1. As part of POC and some initial trials, i have installed Splunk 6.0.1 on my laptop.

Recently i came across iplocation command. I thought i will start using iplocation command and stop using maxmind. So, in my new Splunk installation i added a log file and wrote a simple search

index=main | iplocation allfields=true ClientIP | table *

Note: It is a fresh Splunk installation. While running these tests my laptop is not connected to internet

In my search results I am getting City, Country, lat, lon details. But, as per the links below, the iplocation command uses hostip.info api and it needs internet access.

http://answers.splunk.com/answers/49797/iplocation-and-counting-ips

http://answers.splunk.com/answers/5946/iplocation-command

http://answers.splunk.com/answers/45819/unknown-country-returned-by-iplocation-bug

http://answers.splunk.com/answers/37249/specifying-field-w-iplocation?page=1&focusedAnswerId=37370#3...

I am puzzled.

Could you please let me know:
whether iplocation command needs internet access to retrieve the results?
whether splunk has any in built geo database that is returning the geographic details?

Thanks

Strive

[Jason · Accepted solution]

As of 6.0, iplocation transitioned away from a python script that went to the internet, to a fully-integrated Splunk command that uses a built-in database. (Likely maxmind, from the answer here: http://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command)

No internet access required, anymore.

[strive]

Yes splunk is using maxmind geo lite databases. These databases are updated for every minor release. Since maxmind databases get updated once every week (approximately) we have written python script which pulls the latest db files and replaces the older ones in our system.