Hey @dswoff , AFAIK there is a problem in your logic. The | iplocation command accepts a few arguments, but not like key:value pair as the IP. I believe in your case you want to pass the IP and...
See more...
Hey @dswoff , AFAIK there is a problem in your logic. The | iplocation command accepts a few arguments, but not like key:value pair as the IP. I believe in your case you want to pass the IP and get the Country as result, then try this: index="eventlog" EventCode=1309 | rex field=Message "User host address:\s(?<ip_address>.*)" | iplocation ip_address | table ip_address, Country OR for fixed IP index="eventlog" EventCode=1309 | iplocation "<your_ip_here>" | table ip_address, Country The iplocation accepts an IP and will give you as response the fields: City, Continent, Country, MetroCode, Region, Timezone, lat and lon. Give it a try and let me know