Splunk Search

Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve

jrfreeze
Explorer

I can't seem to get Splunk to run the search necessary to create a choropleth map. Here is my search:

index="main" host="designsafe01.tacc.utexas.edu" PUT /api/public/files/media/published/designsafe.storage.published
| regex "HTTP\/\d\.\d\s200"
| rex "(?[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"

| iplocation wma_ip 
| stats count by Country
| geom geo_countries featureIdField="Country"

It works fine without the last line. I can use geostats to generate cluster maps without a problem.
Any time I try to use the geom command though, I get:

Error in 'SearchOperator:Geom': could not resolve

Any thoughts? I've found a couple of places with things to look for.
One person suggested I should change the settings in the lookup for geo_countries,
but I don't see that lookup.
Isn't that supposed to be there by default?

Thanks,
Joshua

0 Karma

jrfreeze
Explorer

For some reason, this site is not permitting normal field extraction strings. The line starting with "rex" should have 'wma_IP' between less than and greater than signs after the question mark. wma_IP is the name if the field holding the IP address.

I tried leaving a comment correcting it but was deleted from the comment as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...