Currently, we are running 6.6.2 and are using the geolite2 DB to do the iplocation mapping.
I have read the following articles:
https://www.splunk.com/blog/2014/07/22/updating-the-iplocation-db.html
http://www.georgestarcher.com/splunk-updating-the-geoip-database/
However, maxmind states that this DB is End of Life'd. There will be no additional updates after next month.
https://support.maxmind.com/geolite-legacy-discontinuation-notice/
How is Splunk going to handle these lookups in the future? What method of updating will be done?
We have been debating creating a lookup table that utilizes BGP routes. Is there a best practice or built in functionality that accomplishes this already?
We looked at ASNGenerator, but this also relies on the End of Life data from maxmind.
