Does the ip_group_city.csv need to be pushed to Indexers also?

[JohnB]

I haven't gotten it to work. It looks like it wants the ip_group_city.csv on all the indexers.

I keep getting this when I run a search (source="/apps/www-logfile/access/today" | geoip x_client_ip)

[SplunkIndexer] [Errno 2] No such file or directory: '/apps/splunk/etc/apps/maps/lib/ip_group_city.csv'

Any suggestions? I can't push this out to every indexer.

-John

[Stephen_Sorkin · Accepted solution]

Yes, the lib subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/..., which isn't where replicated apps are placed for distributed search.

Since the lib directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop command before the | geoip command to force the command to run on the search head rather than the indexers.