we are using iplocation command
i see that the GeoLite2-City.mmdb file is since 2019
[splunk@ilissplsh01 bin]$ ll /opt/splunk/share/GeoLite2-City.mmdb
-r--r--r-- 1 splunk splunk 60695934 Dec 18 2019 /opt/splunk/share/GeoLite2-City.mmdb
[splunk@ilissplsh01 bin]$
I have downloaded the file from https://www.maxmind.com/en/accounts/532070/geoip/downloads
also I see that there is Geolocation Lookup for Splunk APP (https://splunkbase.splunk.com/app/4102/#/overview) to allow iplocation
what is the recommended way to work with the command ?
thanks
I have installed the Auto Update MaxMind Database on the SH (https://splunkbase.splunk.com/app/5482/#/details)
the GeoLite2-City.mmdb file will be copied to deployment server and deployed to all indexers
also I will create limits.conf on both SH and indexers with the below
splunk@ilisspldepl01 local]$ cat limits.conf
[iplocation]
db_path = /opt/splunk/etc/slave-apps/AM_maxmind_indexers/local/GeoLite2-City.mmdb
[splunk@ilisspldepl01 local]$
is it the right way or I better overwrite the /opt/splunk/share/GeoLite2-City.mmdb on the indexers and the SH ?
thanks a lot
we have a distributed env and we are using deployment server
can't I distribute the file using it ?
You can distribute the app with the deployer (the SH kind, not the deployment server that connects with your forwarders) if you have a search head cluster. If you only have 1 search head then you wouldn't have a deployer.
You'll have to set up a cron on the SHs manually (or by using a system management tool if you have one to set the cron) to pull down the database, something like:
# Gets the database from maxmind at 7am every Wednesday
0 7 * * * 3 /opt/splunk/.../<your app>/bin/getdatabase.sh
Maxmind updates the database on Tuesday, so I would pull the database down on Wednesday since it's unknown exactly when on Tuesday they push an update.
Since you have indexers you'll have to replace those mmdb files as well. The same concept can be applied to the indexers (some script + cron).
If you're talking about just updating the file, you're on the right track. Do you have a distributed environment or a single instance?
Single Instance:
You can download the 'Auto Update Maxmind Database' app on Splunkbase. It creates a Splunk command that downloads the newest DB for you after you put in your license key. Works well enough if you have a single instance.
Distributed Environment:
If you have indexers, search heads, etc. you will have to replace the mmdb file on your indexers as well. This is because iplocation is a distributable streaming command. The app I listed above won't do that, and it also doesn't easily support using a paid database from Maxmind if you choose to upgrade. In my environment I created an app that has a bash script, the database, and limits.conf. The bash script wgets the database (scheduled via cron), and limits.conf changes the location of the database to my app. You can view more information on that process here in a Splunk Blog post.
Hope that helped!
I have installed the Auto Update MaxMind Database on the SH (https://splunkbase.splunk.com/app/5482/#/details)
the GeoLite2-City.mmdb file will be copied to deployment server and deployed to all indexers
also I will create limits.conf on both SH and indexers with the below
splunk@ilisspldepl01 local]$ cat limits.conf
[iplocation]
db_path = /opt/splunk/etc/slave-apps/AM_maxmind_indexers/local/GeoLite2-City.mmdb
[splunk@ilisspldepl01 local]$
is it the right way or I better overwrite the /opt/splunk/share/GeoLite2-City.mmdb on the indexers and the SH ?
Yeah, just a couple things:
Hope that helped!
The limits.conf are different on indexers and SH
we don't have /opt/splunk/etc/system/local/limits.conf
the updated file will be copied with cron to the deployment server
thanks a lot , will test it during the week