Security

Geoip showing error

borisalves
Path Finder

Trying to run a query that return a table with clienIp fails when running command


geoip clientIp

Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'geoip'
Tags (1)
0 Karma
1 Solution

borisalves
Path Finder

It’s described in the documentation that the search peers don’t use the mounted directories for other purposes not directly related to search i.e. the geoip script.

Important: The search peers use the mounted directories only when fulfilling the search head's search requests. For indexing and other purposes not directly related to distributed search, the search peers will use their own, local apps, users, and system directories, the same as any other indexer.

So, I had to copy the maps application to the local apps folder in each Splunk indexer (search peer). Next I had to restart each Splunk indexer so that the new application gets installed and enabled.

I didn’t create a symbolic link because we would have to do it for all shared bundles. Check the documentation here.
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle

View solution in original post

borisalves
Path Finder

It’s described in the documentation that the search peers don’t use the mounted directories for other purposes not directly related to search i.e. the geoip script.

Important: The search peers use the mounted directories only when fulfilling the search head's search requests. For indexing and other purposes not directly related to distributed search, the search peers will use their own, local apps, users, and system directories, the same as any other indexer.

So, I had to copy the maps application to the local apps folder in each Splunk indexer (search peer). Next I had to restart each Splunk indexer so that the new application gets installed and enabled.

I didn’t create a symbolic link because we would have to do it for all shared bundles. Check the documentation here.
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Mounttheknowledgebundle

borisalves
Path Finder

background:
1. Running on a distribute system. Meaning heads and indexer are separated in different hosts
2. Indexer use a shared mount to address configuration files and replicate from search heads
3. Search heads show GeoIp running properly and configured
4. Indexers are showing app installed but unconfigured
the App is looking for the configuration in a place different fro my mount point. Checking the script, a symlink might fix it.
Criticism. App management on distribute installations is rather painful.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>