GeoIP works in Search but not in Enterprise Security?

[echojacques]

Hello,

I installed Google Maps and the geoip command works fine in native Splunk Search. However, when I try to use geoip from within Enterprise Security search, I get this error: "Unknown search command geoip".

Thinking it was a permissions issue, I modified the Google Maps app permissions from Everyone Read to Everyone Read & Write. I also modified the app sharing permissions from 'This app only' to 'All apps'.

Any ideas on how to fix this?

Thanks!

[echojacques · Accepted solution]

To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉