I have fortigate logs for which I have a high level of confidence that the srccountry values are correct.
I selected data from a particular day so that I could do my first cluster map using:
I was seeing some data that looked on the surface to be invalid. iplocation was saying that one of the IPs was in Seychelles off of the coast of Africa while srccountry was correctly indicating that the IP was in the Netherlands.
I then determined the number of entries where iplocation Country did not match srccountry and removed the "where" clause to get the full count:
8,470 of the 29,233 data points (29%) had iplocation Country values that did not match srccountry.
561 of the 8,470 mismatches (7%) had null iplocation Country values.
Are my queries incorrect or...?
Thank you.
By default Splunk uses the free Maxmind database. You are limited to that third party accuracy. Also if you are not updating your database that could be an issue.
By default Splunk uses the free Maxmind database. You are limited to that third party accuracy. Also if you are not updating your database that could be an issue.