When using the iplocation command in Splunk, the MMDB file provided by MaxMind is referenced and the location information is output.

MMDB file update procedure

• Go to $SPLUNK_HOME/etc/system/local on your Splunk server and open limits.conf with a text editor. (If not, create a new limits.conf.)

*The default installation path of $SPLUNK_HOME is as follows.

Linux: /opt/splunk/
Windows: C:\Program Files\splunk

• Add the following settings to limits.conf.

==========
[iplocation]
db_path = <更新するMMDBファイルのフルパス>
==========

(Example) When updating to "GeoLite2-City.mmdb" located in "$SPLUNK_HOME/etc"

==========
[iplocation]
db_path = $SPLUNK_HOME/etc/GeoLite2-City.mmdb
==========

• Please restart the Splunk service.

Supplementary information

If the search head and indexer are separate instances in a distributed environment, update the MMDB files for both the search head and indexer.