Splunk Search

Why is iplocation showing incorrect data ?

zacksoft_wf
Contributor

In my ES App, I have a rule where I noted some discrepancy regarding the source country for the src  ip  112.196.162.127.

Using 'iplocation'  command in SPL it shows as Turkey.
But in whoisdomaintools it shows as India.
112.196.162.127 IP Address Whois | DomainTools.com

Any suggestion why this is the case ?






0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's possible the MaxMind database (source for the iplocation command) is outdated.  What version of Splunk are you using?  Have you tried updating the database (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file for instructions)?

---
If this reply helps you, Karma would be appreciated.
0 Karma

zacksoft_wf
Contributor

I noticed something,
In my query if I write like this I get wrong iplocation data

index=palo_alto_networks TERM(112.196.162.127)
| table _time, sourcetype, src, local_ip Country user_name 
| iplocation  src

But if, I change the iplocation comands position to the middle , it gives the correct country data
like this

index=palo_alto_networks TERM(112.196.162.127)
| iplocation  src
| table _time, sourcetype, src, local_ip Country user_name 



0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first query tries to display the Country field before iplocation has created it, so it's no surprise it doesn't show expected results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...