Extracts location information from IP addresses using 3rd-party databases.
iplocation [prefix=<string>] [allfields=<bool>] [lang=<string>] <ip-address-fieldname>
- Syntax: <field>
- Description: Specify an IP address field, such as
- Syntax: allfields=<bool>
- Description: If true, adds the fields: City, Continent, Country, Region, MetroCode, Timezone, lat (latitude), and lon (longitude). Defaults to false, which means that only the Country, City, Region, lat, and lon fields are added.
- Syntax: lang=<string>
- Description: Render the resulting strings in different languages. For example, use "lang=es" for Spanish. The set of languages depends on the geoip database that is used. To specify more than one language, separate them with a comma. This will also indicate the priority in descending order. Specify, "lang=code" to return the fields as two letter ISO abbreviations.
- Syntax: prefix=<string>
- Description: Specify a string to prefix the field name. This lets you qualify the added field names to avoid name collisions with existing fields. Defaults to NULL/empty string.
The IP address field, specified in ip-address-fieldname, is looked up in a database and location fields information is added to the event. The fields are City, Continent, Country, Region, MetroCode, Timezone, lat (latitude), and lon (longitude). Because all the information may not be available for each IP address, an event can have empty fields.
For IP addresses which do not have a location, such as internal addresses, no fields will be added.
Example 1: Add location information to web access events.
sourcetype=access_* | iplocation clientip
Example 2: Search for client errors in web access events, add location information, and return a table of the IP address, City and Country for each client error.
sourcetype=access_* status>=400 | head 20 | iplocation clientip | table clientip, status, City, Country
Example 3: Prefix the added fields with "iploc_".
sourcetype = access_* | iplocation prefix=iploc_ allfields=true clientip | fields iploc_*
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the iplocation command.
This documentation applies to the following versions of Splunk: 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.0.6 , 6.0.7 , 6.0.8 , 6.1 , 6.1.1 , 6.1.2 , 6.1.3 , 6.1.4 , 6.1.5 , 6.1.6 , 6.1.7 , 6.2.0 , 6.2.1 , 6.2.2