Splunk Search

how to preserve iplocation data

Contributor

The database used by iplocation is updated usually with each new version of Splunk. What is the best solution to preserve the changes? For example a particular IP address might have had a different geolocation last year then it has now.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi imrago,

if you use a customised path for your iplocation DB using limits.conf

[iplocation]

db_path = <path>
* Absolute path to GeoIP database in MMDB format
* If not set, defaults to database included with splunk

it will not get updated by any Splunk version update.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi imrago,

if you use a customised path for your iplocation DB using limits.conf

[iplocation]

db_path = <path>
* Absolute path to GeoIP database in MMDB format
* If not set, defaults to database included with splunk

it will not get updated by any Splunk version update.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

Contributor

Thanks, that solution will preserve the old values, but for new events it would be preferable to use the latest database. Something like we have with the time based lookups in Splunk.

0 Karma

SplunkTrust
SplunkTrust

Well, in this case it would be best for you to create your own lookup table based no your requirements, because this can only be handled by yourself, based on your requirements.

cheers, MuS

0 Karma