answering my own question in my previous post, the parameter "maxout" can solve the misery as its under [subsearch] stanza, which makes sence as geoip is a subsearch not a whole search... but anyhow, changing that parameter's value still did not help at all... no effects!! ... View more

and one other matter I cannot understand, is that the limits.conf file supposably should control all parts of splunk (since its located under system/default) but how come when I enter search query not using geoip, I can easily get billions of results, but the limit problem only occurs when geoip is being used in the search ??! ... View more

thanks for your answers... yes I figured that and its been few days I'm also looking after it, still could not find the right parameter. under limits.conf it seemed the last parameter (max_count) to be the one, but no changes after changing the parameter takes effect... ... View more

I'm having the same problem which was going on in another thread: geoip search results not correct which parameter has to change here?? ... View more

thats great... thanks... and when I want to specify a country?? i've tried these ways, doesnt work and i get errors: SourceIP=* | geoip SourceIP SourceIP_country_name="United States" | stats count(clientip_city) as "City Count" by clientip_city | rename clientip_city as City SourceIP=* | geoip SourceIP | SourceIP_country_name="United States" | stats count(clientip_city) as "City Count" by clientip_city | rename clientip_city as City SourceIP=* | geoip SourceIP_country_name="United States" | stats count(clientip_city) as "City Count" by clientip_city | rename clientip_city as City SourceIP=* | geoip SourceIP AND SourceIP_country_name="United States" | stats count(SourceIP_city) as "City Count" by SourceIP_city | rename SourceIP_city as City SourceIP=* | geoip SourceIP | stats count(SourceIP_city) as "City Count" by SourceIP_city AND SourceIP_country_name="United States" | rename SourceIP_city as City what is the correct way of querying it? ... View more

ok I found another interesting support for the limitation fact I was talking about... I tried this query in Google maps view: DestinationIP=* | geoip DestinationIP It says 22,539 "matching events", and above the map it says: "10000 results with location information ( 1 distinct locations ) over all time" and when I again tried SourceIP=* | geoip SourceIP I get 19,946 "matching events" (same as before) and above the map says: "9984 results with location information ( 1315 distinct locations ) over all time" I said before that I think there is some limit working as a barrier here, and I said somehow its related to results, I think im confirmed here that its related to "results" number, not matching events... and seems to have a limit of "10000" ... any ideas about this kind of configuration...? ... View more

yes I do get new fields like SourceIP_city, SourceIP_country_code, SourceIP_country_name, etc... which is generated by geoip... for the search u said, its taking for ever for it to complete (as I have near 5 billion events). this search is supposed to count per day, right? im believing more and more now that my geoip configuration has some sort of limit up to 20000 in displaying results for example when I search the query SourceIP=* | geoip SourceIP | timechart span=1d count(clientip_city) as "City Count" by clientip_city | rename clientip_city as City it searches in all events, per day, and fetching millions of events, but since its daily, each day will be counted as 1 result overall hence it does not stop the search. but when I search this query: SourceIP=* | geoip SourceIP by itself, it stoppes at 19940... ... View more

ok so now this is my search query: * | geoip SourceIP but again, it only shows me 19940 number of events. (as I said, total is nearly 5 billion!!) is it possible that geoip has some kind of limitation in displaying the results?? P.S: the results from * | geoip SourceIP are exactly similar to my own search method: sourcetype="*" | geoip ... View more

ok... Im getting confused and I need a bit of help here... the clientip here is a predefined search operator/field? or a field name that should be defined by user? none of the above actually gives me any results... maybe I should explain that for all events I am implementing field extraction using field separator "tab" and the field that events originate from is called SourceIP ... View more

thanks for the responses... sourcetype="*" | geoip ??? How can that work. You need to pass a field like a src_ip or client_ip to that search so geoip knows what to graph. Whatever your IP address field is called, just use that in the search: sourcetype="*" | geoip src_ip if I want it to show all events that exists, what should my search be? because I need to get on the map counting all events.. one more issue... is this wrong? : sourcetype="*" | geoip geoip_country_name I get some errors when I perform this search... ... View more

I'm surprised no one has any answers for this post... does this mean that the geoip plugin has that huge problem and no one has ever fixed it?? ... View more

great clarifications... following nick's answer then kristian's update, yes the sourcetype is actually same name followed by a number (not -too-small since is not small). but weired part is that that happens actually from middle of 2 files only (from tail of one file until head of another file is just the other sourcetype) and it is CSV but I recently had to change all "," to tab-separated delimiters, and im trying to re-index, will give u real examples if it happenes again in this indexing... ... View more

thanks for your comprehensive answer. the sourcetype is auto-assigned actually... ok I have to try your says and see what happens. but for now, all i can say is that the log files are some comma separated events, and there are absolutely no difference in format between those in first sourcetype and those in second... ... View more

you have about 90GB that spunk has never seen before great way of clarification... thanks! ... View more