general troubleshooting questions that may help you proceed:
-if you remove the sort and table commands, are any iplocation-generated fields present at all?
-are any IPs truly present in the stream?
-are IPs in the stream publicly routable IPs or internal RFC1918 for which iplocation will not generate results?
-does the mddb file have appropriate permissions for the search instance to access it?
Keep in mind that any alternative to iplocation will also suffice if you find one that generates results.
... View more
Once that issue is resolved, haversine should work for you. I would recommend consulting the iplocation documentation relevant for your Splunk version http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Iplocation
Make especially sure that the MDDB file is available. Note that, in a distributed environment, it is not sent to indexers by default.
... View more
If you place the following just before the haversine command, is the search successful? If so, last_latlon is not always present in the stream data
| search last_latlon!=","
... View more