If you are using MaxMind for GeoIP of NetFlow/sFlow/IPFIX, NetFlow Optimizer solution from NetFlow Logic (https://www.netflowlogic.com) has a cron setting to update it as often as you'd like. In addition, GeoIP enrichment is performed at the time when NetFlow record is processed, not at query time in Splunk. ... View more