Splunk Enterprise

How to Change the geoip database on-premise in a clustered environment?

erlingen
Engager

I read from https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Iplocation : 

 

 

The iplocation command is a distributable streaming command, which means that it can be processed on the indexers. 

 

 

My goal is to sync out a  fetched database from maxmind (GeoLite2-City edition) twice per week to ~/share/GeoLite2-City-custom.mmdb and set this in ~/etc/system/local/limits.conf:

 

 

[iplocation]
db_path = /opt/splunk/share/GeoLite2-custom.mmdb

 

 

My main concern is how to deal with this later, when our sync script fetches a new database and syncs it to the SHC/IDXC. For instance, we have a savedsearch scheduled with cron_schedule = */1 * * * * (Run every minute) that utilizes the iplocation command. We might encounter an issue where the search is run during those seconds the file is being transferred. 

Any recommendations on how to deal with this? Any way to have the scheduled search run every minute of every day except on Wednesdays and Saturdays between 03:05 and 03:10?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...