Splunk Search

Why isn't iplocation report providing the city, country under statistics?

tkerr1357
Path Finder

hello all,

I am trying to figure out why my iplocation report isnt providing the city,country under statistics. Below is my search that is providing the IP field in the table but the other two columns are blank. Any assistance would be great here. 

index=wineventlog EventCode=4624
| search src_ip="*" ComputerName="*" user="*"
| eval "Source IP" = coalesce(src_ip,"")
| eval clientip=src_ip
| iplocation allfields=false "Source IP"
| table "Source IP", city, country

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

"city" and "country" fields are not the same as "City" and "Country".

With splunk field names are case-sensitive.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

"city" and "country" fields are not the same as "City" and "Country".

With splunk field names are case-sensitive.

0 Karma

Stefanie
Builder

Are your IP addresses internal? The iplocation command utilizes information from 3rd party databases to tell it where the IPs are originating from.  Your internal IPs will not work with the IP location command.

 

Try this command. Its an example from Splunk's Documentation

| makeresults 
| eval myip="2001:4860:4860::8888" 
| iplocation myip

If it returns the Country as United Stats and the latitude/longitude then the iplocation command works in your environment.

 

https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Iplocation

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...