All Apps and Add-ons

error code in google maps app

hjwang
Contributor

when i used host="xxx" | geoip dstip , it returns "External search command 'geoip' returned error code 1. First 1000 (of 557330) bytes of script output:" but still output results , now in the same search, but using host="xxx" | geoip srcip , there are no error messages. The fields extraction is correct as expected. what's possibly wrong with this? Thanks

0 Karma
1 Solution

ziegfried
Influencer

The problem is that this version of the geoip command crashes on some specific IP addresses. This will be fixed in the new version that should be released really soon.

The second problem is that the old version of the geoip command does not explicitly require input fields. The new version will do this automatically and will work when there is no automatic field discovery (like when used in saved searches). As a workaround for now, you can explicitly require the field:

<your search> | fields srcip | geoip srcip

or

<your serach> srcip=* | geoip srcip

View solution in original post

ziegfried
Influencer

The problem is that this version of the geoip command crashes on some specific IP addresses. This will be fixed in the new version that should be released really soon.

The second problem is that the old version of the geoip command does not explicitly require input fields. The new version will do this automatically and will work when there is no automatic field discovery (like when used in saved searches). As a workaround for now, you can explicitly require the field:

<your search> | fields srcip | geoip srcip

or

<your serach> srcip=* | geoip srcip

hjwang
Contributor

Thanks a lot, ziegfried. it's really helpful.

0 Karma

hjwang
Contributor

another problem is when i used geoip command in saved search then put it on the views, i found that graph can not be displayed out. But if i type the same command in search bar, this would be shown, something strange!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...