topic Re: GeoASN app search generates red error bar. How to resolve? in All Apps and Add-ons

GeoASN app search generates red error bar. How to resolve?

sonicZ — Mon, 28 Sep 2020 11:57:04 GMT

I've got the GeoASN application installed in our distributed environment(4 indexers so far 1 search head) running the script seems to be generating the generic red error bar saying "results may be incorrect"
Search used:

index=www sourcetype=access_combined splunk_server="splunk*-d*" | lookup ga ip AS clientip | stats count by country, org

error is as follows

Script for lookup table 'ga' returned error code 1. Results may be incorrect

How do we go about troubleshooting this and resolving the error? I am checking python.log web_access and web_service so far nothing pops out as to what the problem is.
basically want to either resolve or in the meantime squelsh the error until we can resolve it.

Re: GeoASN app search generates red error bar. How to resolve?

cnygaard — Wed, 04 Jul 2012 23:46:51 GMT

I got the same error message as you, you will need to install GeoIP and GeoIP python module
take a look in /opt/splunk/etc/apps/GeoASN/README

after that verify that this command works
/opt/splunk/bin/splunk cmd python ga.py < ga.csv

you also need to include the field src_asn in the search results.

Re: GeoASN app search generates red error bar. How to resolve?

mathu — Sun, 20 Oct 2013 10:26:37 GMT

There seems to be a problem with character encoding. i.e. if you lookup countries like "Curaçao", the script will fail because of "ç"

I worked around the problem by changing following line in "ga.py":

replace line:

line[countryi] = unicode(gir['country_name'])

with following two lines:

t = gir['country_name'].decode('cp1252')
line[countryi] = unicode(t)

Re: GeoASN app search generates red error bar. How to resolve?

myron_davis — Mon, 28 Sep 2020 17:46:44 GMT

This has to be deployed to all of the python scripts. i.e. for geoasn.py:

before:
line[src_countryi] = unicode(src_gir['country_name'])

after:
t = src_gir['country_name'].decode('cp1252')
line[src_countryi] = unicode(t)

and

before:
line[dest_countryi] = unicode(dest_gir['country_name'])

after:
t = dest_gir['country_name'].decode('cp1252')
line[dest_countryi] = unicode(t)

Thank you for solving my problem as well.

Re: GeoASN app search generates red error bar. How to resolve?

theeansible — Thu, 29 Jun 2017 18:53:19 GMT

Unfortunately I tried this solution and it still doesn't fix my issue. I followed the guide step by step and was still unable to get it to work.

The weird thing is that it works through the command line however it does not work at the search bar 😕 not sure what else to do.

Re: GeoASN app search generates red error bar. How to resolve?

jonrsplunk — Wed, 04 Apr 2018 12:45:46 GMT

I did a GeoASN install in a distributed environment today and had sismilar problems.
Solution: Install all the components (listed in the README) and the app on all searchheads and indexers.