Splunk Search

Geom command receiving error: Error in 'SearchOperator:Geom': could not resolve

jrfreeze
Explorer

I can't seem to get Splunk to run the search necessary to create a choropleth map. Here is my search:

index="main" host="designsafe01.tacc.utexas.edu" PUT /api/public/files/media/published/designsafe.storage.published
| regex "HTTP\/\d\.\d\s200"
| rex "(?[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"

| iplocation wma_ip 
| stats count by Country
| geom geo_countries featureIdField="Country"

It works fine without the last line. I can use geostats to generate cluster maps without a problem.
Any time I try to use the geom command though, I get:

Error in 'SearchOperator:Geom': could not resolve

Any thoughts? I've found a couple of places with things to look for.
One person suggested I should change the settings in the lookup for geo_countries,
but I don't see that lookup.
Isn't that supposed to be there by default?

Thanks,
Joshua

0 Karma

jrfreeze
Explorer

For some reason, this site is not permitting normal field extraction strings. The line starting with "rex" should have 'wma_IP' between less than and greater than signs after the question mark. wma_IP is the name if the field holding the IP address.

I tried leaving a comment correcting it but was deleted from the comment as well.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...