Why does geoIp database for Iplocation command doesn't provide information about country, city etc. for some IP's?

[rakeshyv0807]

Hi,

I have a table with list of Ip's and their respective locations but for few Ip's the Country and city regions are not being populated. I heard there is a way to update the geoip database but it comes with a limitation that if we upgrade the Splunk version the location file gets reset. is there any other alternative way to generate those results?

Thanks,
Rakesh

[tiagofbmm]

Not all IPs information will be available on the 3rd party databases:

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Iplocation

Extracts location information from IP addresses by using 3rd-party databases.
The IP address that you specify in the ip-address-fieldname argument, is looked up in the database. Fields from that database that contain location information are added to each event. The setting used for the allfields argument determines which fields are added to the events.

Because all the information might not be available for each IP address, an event can have empty field values.

[starcher]

Bonus but not suitable for search head clustering. https://github.com/georgestarcher/TA-geoip

[tiagofbmm]

Nice one!

[tiagofbmm]

Have you checked if those IPs you are talking about are PRIVATE IPs?

Those like 127.0.0.1 won't show you any geographical data

[rakeshyv0807]

@tiagofbmm - I have checked and those are not private ip's.