geoip lookup script fails with error code 1

[responsys_cm]

I'm trying to use the geoip external lookup script, the one that uses the MAXMIND database.

When I run my search, I get the "Script for lookup table 'geoip' returned error code 1. Results may be incorrect."

The search is:

sourcetype=logentry action=login NOT accountname=SysAdmin NOT accountname=ops* NOT username=SYS* NOT src_ip=NULL NOT src_ip=10.* | stats count by accountname,src_ip,username | lookup geoip clientip AS src_ip OUTPUT client_country client_org

I get the same error if I remove the stats command from the pipeline. I can pipe that to something like | search NOT client_country=* to try and find the first result that had a failed lookup. But if I then narrow the initial search to capture that event, it will do the resolution fine.

How can I troubleshoot this? We have a fair number of scheduled searches that do geoip lookups. What happens if two searches try and execute that python script at the same time? It seems to me that the problem happens when the volume of events in the search results are high rather than some kind of bad data screwing up the script.

I'm on Splunk 4.3.2, build 123586.

Thx.

C

[cramasta]

what happens if you run

sourcetype=logentry action=login NOT accountname=SysAdmin NOT accountname=ops NOT username=SYS NOT src_ip=NULL NOT src_ip=10.* | stats count by accountname,src_ip,username | lookup local=true geoip clientip AS src_ip OUTPUT client_country client_org

[mlulmer]

It sounds like you are using distributed search. It seems that the app needs to be installed on all the indexers as well. Please also reference the following link: http://splunk-base.splunk.com/answers/75598/google-maps-where-to-install

[responsys_cm]

Nope... not using distributed search.