Splunk Search

Why does geoIp database for Iplocation command doesn't provide information about country, city etc. for some IP's?

rakeshyv0807
Explorer

Hi,

I have a table with list of Ip's and their respective locations but for few Ip's the Country and city regions are not being populated. I heard there is a way to update the geoip database but it comes with a limitation that if we upgrade the Splunk version the location file gets reset. is there any other alternative way to generate those results?

Thanks,
Rakesh

Tags (1)
0 Karma

tiagofbmm
Influencer

Not all IPs information will be available on the 3rd party databases:

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Iplocation

Extracts location information from IP addresses by using 3rd-party databases.
The IP address that you specify in the ip-address-fieldname argument, is looked up in the database. Fields from that database that contain location information are added to each event. The setting used for the allfields argument determines which fields are added to the events.

Because all the information might not be available for each IP address, an event can have empty field values.

starcher
Influencer

Bonus but not suitable for search head clustering. https://github.com/georgestarcher/TA-geoip

tiagofbmm
Influencer

Nice one!

0 Karma

tiagofbmm
Influencer

Have you checked if those IPs you are talking about are PRIVATE IPs?

Those like 127.0.0.1 won't show you any geographical data

0 Karma

rakeshyv0807
Explorer

@tiagofbmm - I have checked and those are not private ip's.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...