updating geolocation DB

[wainwrid]

Currently, we are running 6.6.2 and are using the geolite2 DB to do the iplocation mapping.

I have read the following articles:

https://www.splunk.com/blog/2014/07/22/updating-the-iplocation-db.html

http://www.georgestarcher.com/splunk-updating-the-geoip-database/

However, maxmind states that this DB is End of Life'd. There will be no additional updates after next month.

https://support.maxmind.com/geolite-legacy-discontinuation-notice/

How is Splunk going to handle these lookups in the future? What method of updating will be done?

We have been debating creating a lookup table that utilizes BGP routes. Is there a best practice or built in functionality that accomplishes this already?

We looked at ASNGenerator, but this also relies on the End of Life data from maxmind.

[richgalloway]

Maxmind is ending the old GeoLite database. Splunk uses GeoLite2, which is not going away.