I have a Cluster Master with a couple of indexers in a cluster. I have a search head that obviously references the indexers. I need to update MMDB and have been able to download the file. I am going to follow various other guides that I have found around updating this process by basically doing something like https://github.com/georgestarcher/TA-geoip. The intent was to
The SPLUNK doco advises that "iplocation" is a distributed search, meaning it will use one of the indexers when the query is run. What is not clear is whether or not I need to update it on my Search Heads as well. If it is using the indexers when the command is run, is there a need to do in on the search heads as well? I suspect the answer with most things like this is to just updated it on the indexers and search heads to avoid unwanted problems but thought I would check in case I missed something.
Install the MMDB file on your search heads as well. The "unwanted problem" to avoid is an iplocation command running on an SH (because it follows a non-distributable command) and using the wrong location database.
Install the MMDB file on your search heads as well. The "unwanted problem" to avoid is an iplocation command running on an SH (because it follows a non-distributable command) and using the wrong location database.