All Apps and Add-ons

GeoIP works in Search but not in Enterprise Security?

echojacques
Builder

Hello,

I installed Google Maps and the geoip command works fine in native Splunk Search. However, when I try to use geoip from within Enterprise Security search, I get this error: "Unknown search command geoip".

Thinking it was a permissions issue, I modified the Google Maps app permissions from Everyone Read to Everyone Read & Write. I also modified the app sharing permissions from 'This app only' to 'All apps'.

Any ideas on how to fix this?

Thanks!

0 Karma
1 Solution

echojacques
Builder

To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉

View solution in original post

0 Karma

echojacques
Builder

To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...