Problem with iplocation showing multiple City and Country fields

[pstutz]

I'm getting unusual results when invoking the iplocation command (listed below). When the table is displayed it marks all results as Private IP space. However in the "other interesting fields" side bar I see multiple City/Country values with an interger appended. For example Country3 with 2 countries (Finland and United States). How can I correct the results of iplocation so that it consolidates City and Country into their respective fields?

Query:

sourcetype="pfsense_pf" fw_action="block" AND interface="vr1" | iplocation | table src_ip, City, Country

Results:

1   73.98.34.1  (Private Address)   (Private Address) (XX)
2   73.98.34.1  (Private Address)   (Private Address) (XX)
3   73.98.34.1  (Private Address)   (Private Address) (XX)
4   73.98.34.1  (Private Address)   (Private Address) (XX)
5   73.98.34.1  (Private Address)   (Private Address) (XX)
6   73.98.34.1  (Private Address)   (Private Address) (XX)
7   73.98.34.1  (Private Address)   (Private Address) (XX)
8   73.98.34.1  (Private Address)   (Private Address) (XX)
9   73.98.34.1  (Private Address)   (Private Address) (XX)
10  73.98.34.1  (Private Address)   (Private Address) (XX)

Other interesting fields (42)
City (1)
City1 (1)
City2 (1)
City3 (2)
City4 (1)
City5 (6)
City6 (1)
City7 (3)
City8 (1)
Country (1)
Country1 (1)
Country2 (1)
Country3 (2)
Country4 (1)
Country5 (2)
Country6 (1)
Country7 (2)
Country8 (1)

[lguinn2]

iplocation is actually a Python script. So you could make a custom version of the script, and have it return the results in a different way.

There is more info in some of the other answers (such as this one) and in the Developer Manual