geoip in a distributed environment

[a212830]

Hi,

We recently upgraded to 6.1.1 and when using the geoip command, we get an error:

"..GeoLifeCity.dat does not exist"

Now, the strange part is that this error is coming from the indexers, but pointing to a patch that only exists on the search-head (the NFS share for search-head pooling). Where does the ip command get executed - on the search-heads, or the indexers? And how would I fix this, if that path doesn't even exist on the indexers?

Edit....

Ok, found the iplocation command, which appears to be Splunks own version of geoip? Is that correct? Any pro's/cons for either one?

[dmaislin_splunk · Accepted solution]

You will want to use the "| iplocation clientip allfields=true" command in conjunction with the geostats to geo the mapping capabilities as a new charting option. This version of Splunk includes OpenStreetMaps tiles or you can use your own tile server for internal maps for example. I hope this helps.

"| iplocation clientip allfields=true | geostats count by clientip"

Save it as a dashboard visualization of chart type map.

And this app gives great examples: http://apps.splunk.com/app/1773/

[a212830]

awesome. thanks!