All Apps and Add-ons

Search crashes when using Google Maps geoip command

spock_yh
Path Finder

I've installed Google Maps and am running a very simple search. It did work for me for a bit but now I keep getting an error. I narrowed it down to the geoip command. I'm running the following search command in the standard search view (not map view):

index="ss_vop_tracking" NOT eventtype=global-filtered-users | geoip remote_ip

and I'm getting the following message in the events are:

[EventsViewer module] Cannot access search data; job 1309041554.40 is a zombie and is no longer with us

I tried filtering the events to ensure that remote_ip is not null and is a valid IP address. When I try piping the results through "head" first, it usually works - even if the limit is higher than the total number of events (where without the "head" it would fail).

Any help would be greatly appreciated.

0 Karma

ziegfried
Influencer

What you're seeing is the whole search process crashing. This might not be directly caused by geoip command. There should be some crash-logs in your $SPLUNK_HOME/var/log/splunk directory. I'd suggest creating a support case with these logs.

Have you installed the Maxmind C API?

0 Karma

spock_yh
Path Finder

Thanks for the quick response. I installed the MAXMIND app and the Google Maps app, not sure if that installs the API as well. I haven't changed any of the default settings though - it's still set to use the python pygeoip API.

Do you happen to know what these crash logs should look like? I'm seeing only the standard set of splunk logs there. Any way to debug what's gone wrong?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...