Splunk Search

geoip lookup script fails with error code 1

responsys_cm
Builder

I'm trying to use the geoip external lookup script, the one that uses the MAXMIND database.

When I run my search, I get the "Script for lookup table 'geoip' returned error code 1. Results may be incorrect."

The search is:

sourcetype=logentry action=login NOT accountname=SysAdmin NOT accountname=ops* NOT username=SYS* NOT src_ip=NULL NOT src_ip=10.* | stats count by accountname,src_ip,username | lookup geoip clientip AS src_ip OUTPUT client_country client_org

I get the same error if I remove the stats command from the pipeline. I can pipe that to something like | search NOT client_country=* to try and find the first result that had a failed lookup. But if I then narrow the initial search to capture that event, it will do the resolution fine.

How can I troubleshoot this? We have a fair number of scheduled searches that do geoip lookups. What happens if two searches try and execute that python script at the same time? It seems to me that the problem happens when the volume of events in the search results are high rather than some kind of bad data screwing up the script.

I'm on Splunk 4.3.2, build 123586.

Thx.

C

Tags (2)

cramasta
Builder

what happens if you run

sourcetype=logentry action=login NOT accountname=SysAdmin NOT accountname=ops NOT username=SYS NOT src_ip=NULL NOT src_ip=10.* | stats count by accountname,src_ip,username | lookup local=true geoip clientip AS src_ip OUTPUT client_country client_org

0 Karma

mlulmer
Explorer

It sounds like you are using distributed search. It seems that the app needs to be installed on all the indexers as well. Please also reference the following link: http://splunk-base.splunk.com/answers/75598/google-maps-where-to-install

0 Karma

responsys_cm
Builder

Nope... not using distributed search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...