Hello,
I installed Google Maps and the geoip command works fine in native Splunk Search. However, when I try to use geoip from within Enterprise Security search, I get this error: "Unknown search command geoip".
Thinking it was a permissions issue, I modified the Google Maps app permissions from Everyone Read to Everyone Read & Write. I also modified the app sharing permissions from 'This app only' to 'All apps'.
Any ideas on how to fix this?
Thanks!
To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉
To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉