Splunk Search

Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve

jrfreeze
Explorer

I can't seem to get Splunk to run the search necessary to create a choropleth map. Here is my search:

index="main" host="designsafe01.tacc.utexas.edu" PUT /api/public/files/media/published/designsafe.storage.published
| regex "HTTP\/\d\.\d\s200"
| rex "(?[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"

| iplocation wma_ip 
| stats count by Country
| geom geo_countries featureIdField="Country"

It works fine without the last line. I can use geostats to generate cluster maps without a problem.
Any time I try to use the geom command though, I get:

Error in 'SearchOperator:Geom': could not resolve

Any thoughts? I've found a couple of places with things to look for.
One person suggested I should change the settings in the lookup for geo_countries,
but I don't see that lookup.
Isn't that supposed to be there by default?

Thanks,
Joshua

0 Karma

jrfreeze
Explorer

For some reason, this site is not permitting normal field extraction strings. The line starting with "rex" should have 'wma_IP' between less than and greater than signs after the question mark. wma_IP is the name if the field holding the IP address.

I tried leaving a comment correcting it but was deleted from the comment as well.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...