|
when i used host="xxx" | geoip dstip , it returns "External search command 'geoip' returned error code 1. First 1000 (of 557330) bytes of script output:" but still output results , now in the same search, but using host="xxx" | geoip srcip , there are no error messages. The fields extraction is correct as expected. what's possibly wrong with this? Thanks |
|
The problem is that this version of the geoip command crashes on some specific IP addresses. This will be fixed in the new version that should be released really soon. The second problem is that the old version of the geoip command does not explicitly require input fields. The new version will do this automatically and will work when there is no automatic field discovery (like when used in saved searches). As a workaround for now, you can explicitly require the field: or Thanks a lot, ziegfried. it's really helpful.
(24 May '11, 19:10)
hjwang
|
another problem is when i used geoip command in saved search then put it on the views, i found that graph can not be displayed out. But if i type the same command in search bar, this would be shown, something strange!!