Why is iplocation showing incorrect data ?

[zacksoft_wf]

In my ES App, I have a rule where I noted some discrepancy regarding the source country for the src  ip  112.196.162.127.

Using 'iplocation'  command in SPL it shows as Turkey.
But in whoisdomaintools it shows as India.
112.196.162.127 IP Address Whois | DomainTools.com

Any suggestion why this is the case ?

[richgalloway]

It's possible the MaxMind database (source for the iplocation command) is outdated.  What version of Splunk are you using?  Have you tried updating the database (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file for instructions)?

[zacksoft_wf]

I noticed something,
In my query if I write like this I get wrong iplocation data

index=palo_alto_networks TERM(112.196.162.127)
| table _time, sourcetype, src, local_ip Country user_name 
| iplocation  src

But if, I change the iplocation comands position to the middle , it gives the correct country data
like this

index=palo_alto_networks TERM(112.196.162.127)
| iplocation  src
| table _time, sourcetype, src, local_ip Country user_name 

[richgalloway]

The first query tries to display the Country field before iplocation has created it, so it's no surprise it doesn't show expected results.