Hi danspav, thank you so much, the query took around 300 sec. on around 10 indexes, 4TB db size and returns what i'm looking for, perfect! ... View more

Thank you very much, that explains it! I was able to complete my little proof of concept, this is my complete search: sourcetype=nftemp | top 100 SRC | eval ip_address = SRC | eval ip_dot_decimal_split=split(ip_address,".") | eval first=mvindex(ip_dot_decimal_split,0),second=mvindex(ip_dot_decimal_split,1),third=mvindex(ip_dot_decimal_split,2),fourth=mvindex(ip_dot_decimal_split,3) | fields - ip_dot_decimal_split | eval first=first*pow(256,3),second=second*pow(256,2),third=third*256 | eval ip_address_integer=first+second+third+fourth | map search=" | inputlookup geobeta | where endIPNum >= $ip_address_integer$ AND startIPNum <= $ip_address_integer$ | eval ip=$ip_address$ | eval mapcount=$count$ | sort mapcount | table mapcount,ip,country_iso_code,latitude,longitude,ASName,ASNumber" maxsearches=20000   The sourcetype is a random generated nftables log with a few IPs in it, then convert the ip's to decimal and do the search against the geobeta lookup. The source of the geobeta lookup contains also only a few records, not sure how it will perform when the geobeta lookup will have millions of records in it, lets see ... geobeta comes from maxmind by the way. ... View more

Hi Giuseppe, thanks for your response. I would like to expand the IPv4 addresses and are looking for lat/lon, country and AS informations. As i do already have the maxmind database in my own mySQL i thought to convert the data into a kvstore and get my data from there. None of the Apps on the market had ready suited for me unless i missed one, so i thought to do this by my own .. its just a hobby ... Cheers Matthias ... View more

That's exactly what i was looking for,  thanks for that. ... View more