All Apps and Add-ons

Google Maps GeoIP Not Working Right?

tfitzgerald15
Explorer

I'm using the Google Maps App for Splunk. When attempting to use the geoip command, it only appears to actually show a small fraction of a percentage (around .0008%) of IPs as having geographical information.

sourcetype="pan_*" | geoip src_ip resolve_hostnames=true

It's searched 188,826 records (all of which contain the src_ip field in standard X.X.X.X format), however it's only stating that there are "166 results with location information ( 16 distinct locations ) over all time".

Using free online tools, I get a better hit ratio than this. Can anyone help me out? I'm guessing I'm doing something wrong with my RegEx.

-Travis

0 Karma

asimagu
Builder

This is a known issue. When using geoip command , for searches with lots of events it has a limitation with the results splunk shows after you run the search with the command. In the background it finds all of them, but it may be showing you only a few. Don’t worry, it has no effect when you want to show stats.

Info: http://splunk-base.splunk.com/answers/37105/geoip-search-results-not-correct?page=1&focusedAnswerId=...

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...