I am evaluating the commercial version of MAXMIND city DB(mmdb) and would like to replace it with the free version that ships out with Splunk. Commercial version of City mdb seems to have more fields than its free version so I would like to know whether the upgrade will break the iplocation in any way or will the iplocation command even display the fields exclusive to commercial version?
Includes the following fields:
Country of Registration (GeoIP2 Only)
Country Represented and Type of Representation (For military bases) (GeoIP2 Only)
Subdivisions (GeoIP2 MMDB Format Only; GeoIP Legacy contains one region)
Longitude (Latitude and Longitude are often near the center of population. These values are not precise and should not be used to identify a particular address or household.)
Metro Code (US only)
GeoNames IDs (for localization and pairing outside data; GeoIP2 only)
That is not possible... the iplocation command is a build in command, it is build in the core code of splunk so you can't change it... what I did was create a custom command that pulled the fields from the database. It is some time ago that I did this but I can have al look to see if I can find the code.