Deployment Architecture

Does the ip_group_city.csv need to be pushed to Indexers also?

Explorer

I haven't gotten it to work. It looks like it wants the ip_group_city.csv on all the indexers.

I keep getting this when I run a search (source="/apps/www-logfile/access/today" | geoip x_client_ip)

[SplunkIndexer] [Errno 2] No such file or directory: '/apps/splunk/etc/apps/maps/lib/ip_group_city.csv'

Any suggestions? I can't push this out to every indexer.

-John

1 Solution

Splunk Employee
Splunk Employee

Yes, the lib subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/..., which isn't where replicated apps are placed for distributed search.

Since the lib directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop command before the | geoip command to force the command to run on the search head rather than the indexers.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yes, the lib subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/..., which isn't where replicated apps are placed for distributed search.

Since the lib directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop command before the | geoip command to force the command to run on the search head rather than the indexers.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!