We use a the GoogleMaps module (1.1.3) in our Splunk 6 advanced XML dashboard and it occasionally fails with the message below (it was also happening in Splunk 5). If we hit CTRL+F5 it will work and the message doesn't appear. Any ideas why this is happening?
Our search query: index=iis host=customhost | geoip c_ip resolve_hostnames=f
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\maps\appserver\modules\GoogleMaps\GoogleMaps.py", line 53, in generateResults
for result in getattr(job, entity_name)[offset:end]:
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search_init.py", line 1332, in __getitem_
self.job.pushValidation()
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search_init_.py", line 637, in pushValidation
raise splunk.SearchException, fatality
SearchException: Error in 'script': Getinfo probe failed for external search command 'geoip'
COMMANDS.CONF:
[geoip]
local=true
This will allow search heads run queries locally and then pass that information to Geoip,