Geolocation data missing when searching

Using the geolocation plug in. I have also added the Sonicwall Content pack. If I look at messages received I see can dst_ip_geolocation and src_ip_geolocation and if I do a search with just the the source import


I can see the geolocation fields, but if I add to the search

gl2_source_input:“595e3aaf83224e0e1b25d857” AND (msg:“XAUTH Succeeded with VPN client” OR m:139) then the geolocation fields are no longer showing. Any help would be much appreciated.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.