MMDB Updating

[willadams]

I have a Cluster Master with a couple of indexers in a cluster.  I have a search head that obviously references the indexers.  I need to update MMDB and have been able to download the file.  I am going to follow various other guides that I have found around updating this process by basically doing something like https://github.com/georgestarcher/TA-geoip.  The intent was to

1. Create a new "app" called something similar on my cluster master under "Master Apps".
2. Push the app via cluster master to my local indexers and let the cluster push this as a "Slave App" to the indexers.

The SPLUNK doco advises that "iplocation" is a distributed search, meaning it will use one of the indexers when the query is run.  What is not clear is whether or not I need to update it on my Search Heads as well.  If it is using the indexers when the command is run, is there a need to do in on the search heads as well?  I suspect the answer with most things like this is to just updated it on the indexers and search heads to avoid unwanted problems but thought I would check in case I missed something.  

[willadams]

• Thanks Rich.

[richgalloway · Accepted solution]

Install the MMDB file on your search heads as well.  The "unwanted problem" to avoid is an iplocation command running on an SH (because it follows a non-distributable command) and using the wrong location database.