I haven't gotten it to work. It looks like it wants the ip_group_city.csv on all the indexers.
I keep getting this when I run a search (source="/apps/www-logfile/access/today" | geoip x_client_ip)
[SplunkIndexer] [Errno 2] No such file or directory: '/apps/splunk/etc/apps/maps/lib/ip_group_city.csv'
Any suggestions? I can't push this out to every indexer.
-John
Yes, the lib
subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/...
, which isn't where replicated apps are placed for distributed search.
Since the lib
directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop
command before the | geoip
command to force the command to run on the search head rather than the indexers.
Yes, the lib
subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/...
, which isn't where replicated apps are placed for distributed search.
Since the lib
directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop
command before the | geoip
command to force the command to run on the search head rather than the indexers.