All Apps and Add-ons

GeoIP works in Search but not in Enterprise Security?

echojacques
Builder

Hello,

I installed Google Maps and the geoip command works fine in native Splunk Search. However, when I try to use geoip from within Enterprise Security search, I get this error: "Unknown search command geoip".

Thinking it was a permissions issue, I modified the Google Maps app permissions from Everyone Read to Everyone Read & Write. I also modified the app sharing permissions from 'This app only' to 'All apps'.

Any ideas on how to fix this?

Thanks!

0 Karma
1 Solution

echojacques
Builder

To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉

View solution in original post

0 Karma

echojacques
Builder

To resolve this, I uninstalled Google Maps and Maxmind and decided to use the iplocation command for geoip information. The iplocation command works just as well - if not better than Google Maps/Maxmind... as long as you don't need a map. As an added bonus, its baked right into Splunk so you don't need to install an additional TA or app (that may or may not need additional debugging) 😉

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!