Splunk Search

Why is iplocation command returning wrong countries?

juancamiloll
Explorer

Hi everyone

I am currently getting logs from microsoft 365 and one of its panels shows the impossible simultaneous locations.

When I check the IP with any page for whois like virustotal or abuseipdb, for example, from Sweden, I find that it really is from another country.

Is there something wrong with the iplocation command or something I need to adjust

How can it be solved?

Labels (2)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

@juancamiloll - As mentioned by @richgalloway it uses the MaxMind database to find the IP location. The MaxMind database is not auto-updated, you need to do it manually or you can use App like https://splunkbase.splunk.com/app/5482/ (Auto Update MaxMind Database) to update it regularly.

As mentioned by @PickleRick , even though you update the MaxMind database regularly there is no guarantee that it will tell you the exact and correct location. Different IP location database generates different results sometimes. 

 

I hope this helps!!!!

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

@juancamiloll - As mentioned by @richgalloway it uses the MaxMind database to find the IP location. The MaxMind database is not auto-updated, you need to do it manually or you can use App like https://splunkbase.splunk.com/app/5482/ (Auto Update MaxMind Database) to update it regularly.

As mentioned by @PickleRick , even though you update the MaxMind database regularly there is no guarantee that it will tell you the exact and correct location. Different IP location database generates different results sometimes. 

 

I hope this helps!!!!

juancamiloll
Explorer

Thank you very much for your help.

I followed the steps downloading the file, then unzipping it and moving it to the /splunk/share folder

I restarted splunk and it already brings me the countries I expected

https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file

richgalloway
SplunkTrust
SplunkTrust

The iplocation command uses a database from MaxMind.  That database is only updated when you install a new version of Splunk, unless you take specific steps to update it yourself.  Depending on the version of Splunk you are using the location database could be very old and outdated.

---
If this reply helps you, Karma would be appreciated.

PickleRick
SplunkTrust
SplunkTrust

You have to remember also that all those ip-geo databases are best-effort only. There is no way to determine a 100% sure location of a given IP. They are usually pretty ok, but sometimes the results can be non-reliable.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...