Why isn't iplocation report providing the city, country under statistics?

[tkerr1357]

hello all,

I am trying to figure out why my iplocation report isnt providing the city,country under statistics. Below is my search that is providing the IP field in the table but the other two columns are blank. Any assistance would be great here. 

index=wineventlog EventCode=4624
| search src_ip="*" ComputerName="*" user="*"
| eval "Source IP" = coalesce(src_ip,"")
| eval clientip=src_ip
| iplocation allfields=false "Source IP"
| table "Source IP", city, country

[PickleRick · Accepted solution]

"city" and "country" fields are not the same as "City" and "Country".

With splunk field names are case-sensitive.

[Stefanie]

Are your IP addresses internal? The iplocation command utilizes information from 3rd party databases to tell it where the IPs are originating from.  Your internal IPs will not work with the IP location command.

Try this command. Its an example from Splunk's Documentation

| makeresults 
| eval myip="2001:4860:4860::8888" 
| iplocation myip

If it returns the Country as United Stats and the latitude/longitude then the iplocation command works in your environment.

https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Iplocation