#Maxmind splunk how to#
#Maxmind splunk update#

#Maxmind splunk update#

A way to update it from the GUI or somewhere else convenient would be nice. This is valid for MaxMinds new 2.0 format, and so far has not shown me any changes in lookup performance, etc.ДЇWITW I believe Splunk should make it more obvious where / how they are distributing this file (and the update frequency). #db_path = /opt/splunk/share/GeoIP2-City.mmdb In nf ~$ cat etc/system/local/nfДb_path = /opt/splunk/share/GeoLite2-City-Latest.mmdb The shell script: ~$ cat $SPLUNK_HOME/bin/scripts/get_maxmind_db.sh This version includes a built in solution for keeping the database files up to date for both free and paid subscribers. This is a rather long time coming, today version 4.0.0 of SecKit for Geolocation with MaxMind is available for Splunk via Splunk base and Splunk cloud. Note that the cron has a weird trick to catch the GeoLite DB updates on the first Tuesday of every month.Д 0 23 * * 3 & $SPLUNK_HOME/bin/scripts/get_maxmind_db.sh > $OUTFILE 2>&1 Keeping that up with MaxMind for Splunk and Splunk Cloud. Here's how I solve this problem in our deployment using cron and shell scripts. I also discovered that MaxMind recently released a new '2.0' version of their free Location DB called GeoLite2. It lead me down an interesting search into IP location databases and how accurate they are and how much they cost, etc. I recently discovered (maybe even by reading this question) that Splunk does not automatically update their GeoIP data. ++++ Edit 4/14/14: I searched the /splunk for * geo* (not sure why I didn't do this earlier!) and found this file: /splunk/share/ipv4.geodbДoes anyone know if this is Splunk's geoip database for the iplocation command? And if so, same question stands. Also, I found that the iplocation command produces much better results (more complete) than Maxmind's 'lookup geoip.' command (doesn't have geoip info for many IPs in our logs, which is why I prefer to use Splunk's iplocation command). This also explains why the iplocation command will continue to work even if you uninstall the Maxmind app (and delete all of the directories as well). The results were different, proving that Splunk's iplocation command does not use Maxmind's geoip database. After re-installing Maxmind and restarting Splunk, I ran two identical searches with geoip lookups: one with Splunk's iplocation and the other with Maxmind's geoip command. +++ Edit 4/4/14: I re-installed Maxmind per a recent suggestion that Splunk's iplocation command uses Maxmind's geoip database.

#Maxmind splunk how to#

++ Edit: I also checked the iplocation documentation but it doesn't describe how to update the geoip database: Since this is Splunk's 'built-in' geoip command, does the underlying geoip database get automatically updated or do I have to manually update it? If manual, how do I update it? I use Splunk's iplocation (not Maxmind or other) command extensively in our monitoring dashboards.