Yes, the lib subdirectory of apps is not replicated for distributed search. Also, this app refers to the absolute path $SPLUNK_HOME/etc/apps/maps/lib/... , which isn't where replicated apps are placed for distributed search.
Since the lib directory is large (over 100MB), I wouldn't recommend that the app author make the app replicate fully (as that will cause search slowdown when replication takes place). Instead I'd probably change the search to include the | localop command before the | geoip command to force the command to run on the search head rather than the indexers.
... View more