Extracts location information from IP addresses by using 3rd-party databases. Supports IPv4 and IPv6.
The IP address field, specified in the
ip-address-fieldname argument, is looked up in a database. Location fields information is added to the event. The fields are City, Continent, Country, Region, MetroCode, Timezone, lat (latitude), and lon (longitude). Because all the information might not be available for each IP address, an event can have empty fields.
For IP addresses which do not have a location, such as internal addresses, no fields are added.
iplocation [prefix=<string>] [allfields=<bool>] [lang=<string>] <ip-address-fieldname>
- Syntax: <field>
- Description: Specify an IP address field, such as
- Syntax: allfields=<bool>
- Description: If true, adds the fields City, Continent, Country, Region, MetroCode, Timezone, lat (latitude), and lon (longitude).
- Default: false, meaning only the Country, City, Region, lat, and lon fields are added
- Syntax: lang=<string>
- Description: Render the resulting strings in different languages. For example, use "lang=es" for Spanish. The set of languages depends on the geoip database that is used. To specify more than one language, separate them with a comma. This also indicates the priority in descending order. Specify "lang=code" to return the fields as two letter ISO abbreviations.
- Syntax: prefix=<string>
- Description: Specify a string to prefix the field name. This lets you qualify the added field names to avoid name collisions with existing fields.
- Default: NULL/empty string
Add location information to web access events.
sourcetype=access_* | iplocation clientip
Search for client errors in web access events, add location information, and return a table of the IP address, City, and Country for each client error.
sourcetype=access_* status>=400 | head 20 | iplocation clientip | table clientip, status, City, Country
Prefix the added fields with "iploc_".
sourcetype = access_* | iplocation prefix=iploc_ allfields=true clientip | fields iploc_*
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the iplocation command.
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.5.0, 6.5.1