https://community.splunk.com/t5/Splunk-Enterprise-Security/Error-When-Using-DNSLOOKUP-Command/m-p/431335#M5622 <P>I`m trying to run a search using dnslookup.</P> <P>index=MY_INDEX host=MY_HOST<BR /> | lookup dnslookup clienthost as host output clientip as ip_address</P> <P>I run the search from one of my SH and from my Indexers and It runs successfully. But when the search runs in my other SH, I got the errors below:</P> <P>[INDEXER_1] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.<BR /> [INDEXER_1] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.<BR /> [INDEXER_2] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.<BR /> [INDEXER_2] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.<BR /> [INDEXER_3] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.<BR /> [INDEXER_3] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.</P> <P>All the configuration files in both Search Heads are the same. Does anyone have any tips about this issue?</P> Tue, 29 Sep 2020 23:38:05 GMT alonsocaio 2020-09-29T23:38:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Error-When-Using-DNSLOOKUP-Command/m-p/431335#M5622 <P>I`m trying to run a search using dnslookup.</P> <P>index=MY_INDEX host=MY_HOST<BR /> | lookup dnslookup clienthost as host output clientip as ip_address</P> <P>I run the search from one of my SH and from my Indexers and It runs successfully. But when the search runs in my other SH, I got the errors below:</P> <P>[INDEXER_1] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.<BR /> [INDEXER_1] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.<BR /> [INDEXER_2] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.<BR /> [INDEXER_2] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.<BR /> [INDEXER_3] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.<BR /> [INDEXER_3] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.</P> <P>All the configuration files in both Search Heads are the same. Does anyone have any tips about this issue?</P> Tue, 29 Sep 2020 23:38:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Error-When-Using-DNSLOOKUP-Command/m-p/431335#M5622 alonsocaio 2020-09-29T23:38:05Z