topic Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"? in All Apps and Add-ons

SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

ebailey — Tue, 16 Feb 2016 04:44:17 GMT

I am getting unknown command. I exported the app globally so I do not think this a permissions issue.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Tue, 16 Feb 2016 21:59:36 GMT

ebaiey can you copy and paste the search you attempted to run. This app does not have an external command I used external lookup for performance reasons.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Sat, 20 Feb 2016 13:56:36 GMT

Wanted to follow up feel free to email me or direct message I can help you get this working

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Fri, 26 Feb 2016 21:14:40 GMT

The feature is is implemented as a external lookup not a command. To utilize the lookup the macro back ticks are needed. I realized finally that the MarkDown syntax on the documentation page was consuming the ticks making the documentation render incorrectly I found a way to no have that happen now so the documentation is now correct.
https://splunkbase.splunk.com/app/3022/#/documentation

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

axin — Fri, 26 Feb 2016 21:39:14 GMT

Getting the same error on splunk 6.3.3

Search:
index=* sourcetype=mylogs earliest=-1h | seckit_iplocation(ip)

"Unknown search command 'seckit'. "

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

axin — Fri, 26 Feb 2016 21:46:05 GMT

Thanks, it's finding the command now, but now i run into this error

[] Script for lookup table 'SecKitIPLocation' returned error code 1. Results may be incorrect.

any suggestions on how to debug?

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Fri, 26 Feb 2016 22:38:57 GMT

verify the max mind files you are licensed for downloaded into the data folder.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

ebailey — Thu, 10 Mar 2016 19:52:09 GMT

Here are the maxmind files I have in the data directory

-rw-r--r-- 1 splunk splunk 27386100 Feb 15 23:02 GeoIP2-ISP.mmdb
-rw-r--r-- 1 splunk splunk 96409528 Feb 15 23:06 GeoIP2-City.mmdb
-rw-r--r-- 1 splunk splunk 2525314 Feb 15 23:07 GeoIP2-Country.mmdb

Do I need more?

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

ebailey — Thu, 10 Mar 2016 19:52:55 GMT

@rfaircloth Thanks for creating this tool - it is very helpful.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Fri, 11 Mar 2016 15:14:44 GMT

This app is not implemented as a search command, we are using external lookup, I provided a macro which requires the back tick

index=* sourcetype=mylogs earliest=-1h | `seckit_iplocation(ip)`

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Fri, 11 Mar 2016 15:16:43 GMT

Just wanted to check did you get past this, if not send me a private message I can webex with you

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

gmenghini — Tue, 29 Sep 2020 10:00:49 GMT

I am getting the same error (Script for lookup table 'SecKitIPLocation' returned error code 1)? How did you solve the problem?

The python script is located here:/opt/splunk/etc/apps/SecKit_SA_geolocation/bin
and the corresponding Maxmind Data here: /opt/splunk/etc/apps/SecKit_SA_geolocation/data

Any suggestions are welcome.

Thanks.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Thu, 16 Jun 2016 22:06:13 GMT

Per the documentation this is a macro not a command you must as with any search macro use the back tick ` please copy and paste spl from the documentation.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

gmenghini — Fri, 17 Jun 2016 05:20:55 GMT

@rfaircloth: As explained in one of your earlier posts, I used the back tick ` when executing the command. I used exactly the spl from the documentation and tried also many other options - still the same error. However, I just realized the error message comes from the splunk indexer (search head and indexer are on different servers). Do I have to install the app also on the indexer or adapt some configuration? Many thanks.

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

rfaircloth_splu — Fri, 17 Jun 2016 22:23:04 GMT

I apologize when I read your question I did not understand the error. Can you send me the search.log file from the SH and one indexer?
Also list the mmdb files in the app directory

Re: SecKit for geolocation with Maxmind: Why am I getting error "unknown command"?

gmenghini — Mon, 20 Jun 2016 06:01:42 GMT

I could solve the problem - it works now! The problem was the missing GeoLite mmdb in the data folder of the app. It seems to be that some information (e.g. city, country etc.) comes from this database and I only had the GeoIP mmdb for getting further details (e.g. ISP etc.).