topic Re: GeoIP app not working correctly in Splunk Search

GeoIP app not working correctly

castle1126 — Tue, 03 Aug 2010 04:17:06 GMT

Hi, I downloaded (installed via Splunk GUI) and am testing out the GeoIP app on my 4.1.4 search head. I'm having an issue though. When I run a search against my proxy data I get no returned information from the GeoIP lookups. The search command I'm running is:

index=weblog | lookup geoip clientip as ip

I do know that after downloading the app I restarted Splunk. I get no errors in logs or at the GUI when I'm issuing the searches.

Any idea on what I'm doing wrong?

Thanks! Steve

Re: GeoIP app not working correctly

ftk — Tue, 03 Aug 2010 04:24:15 GMT

Splunk now has a command for ip lookups built in -- iplocation. This might be easier to use than the GeoIP app.

Re: GeoIP app not working correctly

castle1126 — Tue, 03 Aug 2010 21:20:46 GMT

This is an expensive (resource) task on my system. In most of my events I will have at least 2 IP addresses that are extracted via CSV field extraction - which give pretty fast field extractions. IPLocation trying to find the IP in the _raw of these events doesn't come across as optimal. Plus iplocation doesn't give me the opportunity to "give" the lookup an IP address.

Re: GeoIP app not working correctly

araitz — Tue, 03 Aug 2010 22:09:27 GMT

I use geoip all the time, and I have never had any problems with the expense of the operation.

Try using localop:

index=weblog | localop | lookup geoip clientip as ip

http://www.splunk.com/base/Documentation/4.1.4/SearchReference/Localop

Re: GeoIP app not working correctly

castle1126 — Tue, 03 Aug 2010 22:34:46 GMT

Thanks! The localop did the trick!

Re: GeoIP app not working correctly

Justin_Grant — Thu, 26 Aug 2010 04:46:01 GMT

hi @castle1126 - instead of adding a new answer (like you'd do on a traditional forum), on Splunk Answers you'll want to add a comment on the correct answer and "accept" it by clicking the checkmark. Thanks!