Splunk Search

Is the iplocation command compatible with the commercial version of MAXMIND mmdb?

Path Finder

I am evaluating the commercial version of MAXMIND city DB(mmdb) and would like to replace it with the free version that ships out with Splunk. Commercial version of City mdb seems to have more fields than its free version so I would like to know whether the upgrade will break the iplocation in any way or will the iplocation command even display the fields exclusive to commercial version?

For reference:
1) iplocation
City, Continent, Country, Region, MetroCode, Timezone, lat (latitude), and lon (longitude).

2) maxmind


Includes the following fields:
Country of Registration (GeoIP2 Only)
Country Represented and Type of Representation (For military bases) (GeoIP2 Only)
Subdivisions (GeoIP2 MMDB Format Only; GeoIP Legacy contains one region)
City Name
Postal Code
Longitude (Latitude and Longitude are often near the center of population. These values are not precise and should not be used to identify a particular address or household.)
Accuracy Radius
Metro Code (US only)
Time zone
GeoNames IDs (for localization and pairing outside data; GeoIP2 only)

Any ideas ?

Tags (2)


you can change the free database with the commercial one and it will work, you don't get the extra fields however.

if you create an limits.conf and use the "db_path" option you can point splunk to the new database and don't have to replace the existing one.

also see: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Biplocation.5D


Do you by any chance know how you can change the default iplocation command to return the extra fields that come with the premium version?

I'm struggling locating the iplocation script, it's not in etc/apps/search/bin as expected.

0 Karma


That is not possible... the iplocation command is a build in command, it is build in the core code of splunk so you can't change it... what I did was create a custom command that pulled the fields from the database. It is some time ago that I did this but I can have al look to see if I can find the code.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...