https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100449#M14237 <P>It’s described in the documentation that the search peers don’t use the mounted directories for other purposes not directly related to search i.e. the geoip script.</P> <P>Important: The search peers use the mounted directories only when fulfilling the search head's search requests. For indexing and other purposes not directly related to distributed search, the search peers will use their own, local apps, users, and system directories, the same as any other indexer.</P> <P>So, I had to copy the maps application to the local apps folder in each Splunk indexer (search peer). Next I had to restart each Splunk indexer so that the new application gets installed and enabled. </P> <P>I didn’t create a symbolic link because we would have to do it for all shared bundles. Check the documentation here.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle</A></P> Fri, 25 Jan 2013 21:48:53 GMT borisalves 2013-01-25T21:48:53Z https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100447#M14235 <P>Trying to run a query that return a table with clienIp fails when running command <BR /> <PRE><BR /> geoip clientIp<BR /> </PRE></P> <PRE> Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'geoip' </PRE> Fri, 25 Jan 2013 20:15:13 GMT https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100447#M14235 borisalves 2013-01-25T20:15:13Z https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100448#M14236 <P>background:<BR /> 1. Running on a distribute system. Meaning heads and indexer are separated in different hosts<BR /> 2. Indexer use a shared mount to address configuration files and replicate from search heads<BR /> 3. Search heads show GeoIp running properly and configured<BR /> 4. Indexers are showing app installed but unconfigured<BR /> the App is looking for the configuration in a place different fro my mount point. Checking the script, a symlink might fix it.<BR /> Criticism. App management on distribute installations is rather painful.</P> Fri, 25 Jan 2013 20:45:00 GMT https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100448#M14236 borisalves 2013-01-25T20:45:00Z https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100449#M14237 <P>It’s described in the documentation that the search peers don’t use the mounted directories for other purposes not directly related to search i.e. the geoip script.</P> <P>Important: The search peers use the mounted directories only when fulfilling the search head's search requests. For indexing and other purposes not directly related to distributed search, the search peers will use their own, local apps, users, and system directories, the same as any other indexer.</P> <P>So, I had to copy the maps application to the local apps folder in each Splunk indexer (search peer). Next I had to restart each Splunk indexer so that the new application gets installed and enabled. </P> <P>I didn’t create a symbolic link because we would have to do it for all shared bundles. Check the documentation here.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle</A></P> Fri, 25 Jan 2013 21:48:53 GMT https://community.splunk.com/t5/Security/Geoip-showing-error/m-p/100449#M14237 borisalves 2013-01-25T21:48:53Z