How to update iplocation database

Available Languages

Updated:September 29, 2026

Document ID:SPLK045675

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Splunk Cloud

Description

One must have a role with the upload_mmdb_files capability as a prerequisite to update the iplocation database
https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/Rolesandcapabilities

Resolution

Steps to update:
1. Go online and find a download page ( http://dev.maxmind.com/geoip/geoip2/geolite2/) for the binary .tar.gz versions of the GeoLite2-City or the GeoIP2-City database files.
2. Download the binary .tar.gz version of the file (GeoLite2-City or GeoIP2-City) that is most appropriate for your needs.
3. Expand the binary .tar.gz version of the file.
The .tar.gz file expands into a that which contains the GeoLite2-City.mmdb file, or the GeoIP2-City.mmdb file, depending on the download you selected.
4. In Splunk Web, go to Settings > Lookups > GeoIP lookups file.
5. On the GeoIP lookups file page, click Choose file. Select the .mmdb file.
6. Click Save.

The page displays a success message when the upload completes.

How to update iplocation database

Available Languages

Bias-Free Language

Applicability

Description

Resolution

Related Links

Revision History

Was this Document Helpful?

Contact Cisco

This Document Applies to These Products

Related Articles