Splunk Search

iplocation returning erronius results

lavster
Path Finder

Hello, we are seeing some strange results when trying to map RAS connections to our organisation..

The search i am running "index=cisco_collect_std sourcetype=cisco:asa "New Connection Established" |iplocation Remote_IP" shows that we have several connections from India, Ukraine, Egypt but when we check the IP address it is actually based in the UK.

an example of the data this search is working on is here.

Nov 21 10:58:52 10.174.128.11 Nov 21 2019 10:58:52 CR2PDMZASA02 : %ASA-5-750006: Local:10.xxx.xxx.21:4500 Remote:84.68.89.156:65100 Username:xxxxxx IKEv2 SA UP. Reason: New Connection Established

and the regex for Remote_IP is pulling out 84.68.89.156

We have updated the mmdb and also when we interogate the database using iplocation it returns the correct location.

any advice what could be going on here would be great

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Did you update the database on indexers as well as search heads?

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

Did you update the database on indexers as well as search heads?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...