https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29575#M778 <P>We have our search heads pooled in batches of 4. I installed Google Maps into the shared application directory and have restarted all search heads, but I'm encountering an error when trying to use the geoip command. <STRONG>Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'geoip'</STRONG></P> <P>Should I be installing this app on all of our indexers? Should I install it on our deployment server and then have one of our serverClasses handle getting it to our search heads and/or indexers?</P> <P>I see this error referenced in quite a few places on SplunkBase, but I'm not really finding a similar situation to compare ours to.</P> <P>Thank you.</P> Tue, 12 Feb 2013 23:42:14 GMT pkeller 2013-02-12T23:42:14Z https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29575#M778 <P>We have our search heads pooled in batches of 4. I installed Google Maps into the shared application directory and have restarted all search heads, but I'm encountering an error when trying to use the geoip command. <STRONG>Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'geoip'</STRONG></P> <P>Should I be installing this app on all of our indexers? Should I install it on our deployment server and then have one of our serverClasses handle getting it to our search heads and/or indexers?</P> <P>I see this error referenced in quite a few places on SplunkBase, but I'm not really finding a similar situation to compare ours to.</P> <P>Thank you.</P> Tue, 12 Feb 2013 23:42:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29575#M778 pkeller 2013-02-12T23:42:14Z https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29576#M779 <P>You can test if this is a distributed search issue where it's trying to execute the command on the Indexers by using splunk_server in a search and piping to geoip:</P> <PRE><CODE>... splunk_server=localhost | geoip src_ip </CODE></PRE> <P>If running the command local on the search head solves the issue, you can make a more permanent solution to tell Splunk to execute the command only on search heads, like this:</P> <PRE><CODE>COMMANDS.CONF: [geoip] local=true </CODE></PRE> Wed, 13 Feb 2013 23:06:54 GMT https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29576#M779 Ron_Naken 2013-02-13T23:06:54Z https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29577#M780 <P>I was running into the same problem today. We have 4 Indexers and 7 Search Heads running. First In installed Google Maps on one of the Search Heads, resulting in the same error message stated above.<BR /> Then I have installed it on one of the indexers and run the geoip command locally on this Indexer, which was running fine. In the last step I installed the app on all 4 Indexers, and then it was running fine fro the Search Head as well.</P> Fri, 26 Apr 2013 11:50:02 GMT https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29577#M780 nhamel 2013-04-26T11:50:02Z https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29578#M781 <P>Ron,</P> <P>If you run the geoip from the search head Only, Will you still get the data from the indexers?</P> Tue, 03 Dec 2013 15:59:39 GMT https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29578#M781 hartfoml 2013-12-03T15:59:39Z https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29579#M782 <P>you will, but you will not be able to utilize any distributed map(reduce) function on geoip / geostats part,that will be on the search head</P> Mon, 28 Apr 2014 12:51:30 GMT https://community.splunk.com/t5/Deployment-Architecture/Google-Maps-Where-to-install/m-p/29579#M782 lmyrefelt 2014-04-28T12:51:30Z