Geoip showing error

[borisalves]

Trying to run a query that return a table with clienIp fails when running command

geoip clientIp

Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'geoip'

[borisalves · Accepted solution]

It’s described in the documentation that the search peers don’t use the mounted directories for other purposes not directly related to search i.e. the geoip script.

Important: The search peers use the mounted directories only when fulfilling the search head's search requests. For indexing and other purposes not directly related to distributed search, the search peers will use their own, local apps, users, and system directories, the same as any other indexer.

So, I had to copy the maps application to the local apps folder in each Splunk indexer (search peer). Next I had to restart each Splunk indexer so that the new application gets installed and enabled.

I didn’t create a symbolic link because we would have to do it for all shared bundles. Check the documentation here.
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle

[borisalves]

background:
1. Running on a distribute system. Meaning heads and indexer are separated in different hosts
2. Indexer use a shared mount to address configuration files and replicate from search heads
3. Search heads show GeoIp running properly and configured
4. Indexers are showing app installed but unconfigured
the App is looking for the configuration in a place different fro my mount point. Checking the script, a symlink might fix it.
Criticism. App management on distribute installations is rather painful.