Splunk 6 has many awesome new features, one of which is built-in IP geolocation. No longer do you have to manually lookup up city, state, and country when investigating logs – Splunk will do that for you. This page has the details.
For example, if I want my x_forwarded_for IP addresses to have geolocation, I tack this at the end of my query:
| iplocation x_forwarded_for | stats count by x_forwarded_for City Region Country
The fields iplocation can produce are:
You can combine this query with DNS lookups (as detailed here) for a more complete picture of your data.
<search query> | iplocation x_forwarded_for | lookup dnslookup clientip as x_forwarded_for OUTPUT clienthost as hostname | stats count by x_forwarded_for City Region Country hostname