Splunk Search

Why are the iplocations not working at all?

robertlynch2020
Motivator

Hi

My iplocation is not working at all, what am i missing?

index=_internal sourcetype=splunkd_ui_access | stats count by clientip   | iplocation clientip

I don't get any city or country at all.

alt text

I am on Splunk Version:7.1.6 [Dec 2018], these are the files i currently have in the directory.
Do i need to update them to get this to work, or should something work by default?

alt text

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Those all IPs are private IPs (https://en.wikipedia.org/wiki/Private_network) and for private IP there are no IP location because these IP ranges are specifically reserved for Internal network.

View solution in original post

0 Karma

riddhipv
Engager

I have same issue and the IPs are public IPs too.

0 Karma

knielsen
Contributor

There are only private IP addresses in your screenshot, no public ones. There is no location lookup for private IP addresses.

The iplookup command itself works, otherwise you wouldn't get the columns for City and Country. It is just not possible to determine these for private IPs.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Those all IPs are private IPs (https://en.wikipedia.org/wiki/Private_network) and for private IP there are no IP location because these IP ranges are specifically reserved for Internal network.

View solution in original post

0 Karma

robertlynch2020
Motivator

ok- cheers and thanks

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!