Deployment Architecture

Does the ip_group_city.csv need to be pushed to Indexers also?

JohnB
Explorer

I haven't gotten it to work. It looks like it wants the ip_group_city.csv on all the indexers.

I keep getting this when I run a search (source="/apps/www-logfile/access/today" | geoip x_client_ip)

[SplunkIndexer] [Errno 2] No such file or directory: '/apps/splunk/etc/apps/maps/lib/ip_group_city.csv'

Any suggestions? I can't push this out to every indexer.

-John

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes, the lib subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/..., which isn't where replicated apps are placed for distributed search.

Since the lib directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop command before the | geoip command to force the command to run on the search head rather than the indexers.

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes, the lib subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/..., which isn't where replicated apps are placed for distributed search.

Since the lib directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop command before the | geoip command to force the command to run on the search head rather than the indexers.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...