I read from https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Iplocation :
The iplocation command is a distributable streaming command, which means that it can be processed on the indexers.
My goal is to sync out a fetched database from maxmind (GeoLite2-City edition) twice per week to ~/share/GeoLite2-City-custom.mmdb and set this in ~/etc/system/local/limits.conf:
[iplocation]
db_path = /opt/splunk/share/GeoLite2-custom.mmdb
My main concern is how to deal with this later, when our sync script fetches a new database and syncs it to the SHC/IDXC. For instance, we have a savedsearch scheduled with cron_schedule = */1 * * * * (Run every minute) that utilizes the iplocation command. We might encounter an issue where the search is run during those seconds the file is being transferred.
Any recommendations on how to deal with this? Any way to have the scheduled search run every minute of every day except on Wednesdays and Saturdays between 03:05 and 03:10?
