topic Re: Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1? in All Apps and Add-ons

Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1?

Michael — Tue, 13 May 2014 21:15:25 GMT

Love this app!
Worked fine with 6.0.2 -- but broke when I applied 6.1 (build 206881).

"Script for lookup table 'geoip' returned error code 1. Results may be incorrect. "

Any ideas?
If the developers are around -- pretty please fix?

Re: Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1?

martin_mueller — Tue, 13 May 2014 22:11:51 GMT

Consider using iplocation: http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/iplocation

Re: Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1?

Michael — Wed, 14 May 2014 12:35:10 GMT

Thanks. Just tried it, works well enough.

Bummer though, all that invested time in getting my dashboards and reports created with geoip -- just another thing to add to my todo list, editing them...

Re: Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1?

martin_mueller — Wed, 14 May 2014 22:05:30 GMT

Well... the app you linked isn't marked as compatible with Splunk 6.

As for finding searches to edit, you can use Splunk for that. Call the saved searches REST endpoint in the regular search bar and filter like this: regex search="\|\s*geoip".

Re: Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1?

delfering — Fri, 30 May 2014 17:03:39 GMT

Same boat at the OP. Trying the suggestion but I'm seeing different results using iplocation. Wonder if it is as accurate as the Maxmind database?

Re: Geo Location Lookup Script (powered by MAXMIND) -- broken with 6.1?

martin_mueller — Sun, 01 Jun 2014 16:37:30 GMT

Different results could be different database ages, or different accuracies. Remember, IP to location lookups aren't an exact science - one address can be assigned to different locations dynamically as well.

I think the DB used by the iplocation command is sitting somewhere in $SPLUNK_HOME, forgot where though. Maybe you can replace it with a commercial high-accuracy one yourself.