Splunk Search

Why does geoIp database for Iplocation command doesn't provide information about country, city etc. for some IP's?

rakeshyv0807
Explorer

Hi,

I have a table with list of Ip's and their respective locations but for few Ip's the Country and city regions are not being populated. I heard there is a way to update the geoip database but it comes with a limitation that if we upgrade the Splunk version the location file gets reset. is there any other alternative way to generate those results?

Thanks,
Rakesh

Tags (1)
0 Karma

tiagofbmm
Influencer

Not all IPs information will be available on the 3rd party databases:

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Iplocation

Extracts location information from IP addresses by using 3rd-party databases.
The IP address that you specify in the ip-address-fieldname argument, is looked up in the database. Fields from that database that contain location information are added to each event. The setting used for the allfields argument determines which fields are added to the events.

Because all the information might not be available for each IP address, an event can have empty field values.

starcher
Influencer

Bonus but not suitable for search head clustering. https://github.com/georgestarcher/TA-geoip

tiagofbmm
Influencer

Nice one!

0 Karma

tiagofbmm
Influencer

Have you checked if those IPs you are talking about are PRIVATE IPs?

Those like 127.0.0.1 won't show you any geographical data

0 Karma

rakeshyv0807
Explorer

@tiagofbmm - I have checked and those are not private ip's.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...