I can answer my own question now, as I've just fixed this with help from Splunk support. I had to do the following: 1) Install the google maps app on the search head and on the indexers - don't use the "cluster bundle" technique - actually log into the indexers and install the app that way. 2) Make the fix in this ticket http://answers.splunk.com/answers/135685/geoip-command-stops-working-after-upgrade-to-611-geoip-database-file-geolitecitydat-does-not-exist to the geopip config file on the search head only 3) Restart head and three indexers ... View more

I think the answer is that either: This doesn't work - you can't have index time fields carried out by indexers in a cluster or It is because I was using a heavy forwarder - i.e. it believed the indexing work had already been done. I didn't realise I was using a heavy forwarder, but I've fixed my problem by moving the indexing config to the forwarder instead and it is all behaving as expected now ... View more