Streamed Search Execute Failed Because: Error in 'lookup' command

JoshuaJJ — Wed, 20 Mar 2024 17:04:19 GMT

Good morning,

I am having issues with admon and running into this error:

Streamed Search Execute Failed Because: Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/var/run/searchpeers/B3E####/apps/Splunk_TA_Windows/bin/user_account_control_property.py'..

Transforms on indexer

#########Active Directory ##########

[user_account_control_property]

external_cmd = user_account_control_property.py userAccountControl userAccountPropertyFlad

external_type = python

field_list = userAccountControl, userAccountPropertyFlag

python.version = python3

Script is located within the bin directory of the App .../bin/user_account_control_property

The error is happening when I run this search index=test source=ActiveDirectory

I have an app created called ADMON on the deployment server which is being deployed to my primary domain controllers. At first, I saw a ton of sync data, after that it was erroring out with the above error message.

Re: Streamed Search Execute Failed Because: Error in 'lookup' command

marnall — Wed, 20 Mar 2024 21:43:57 GMT

At first glance it seems your field/argument "userAccountPropertyFlag" ends with a 'd' character when passed to the script: "userAccountPropertyFlad"

If that doesn't fix it, you may be able to find more informational errors by searching in the internal error logs relating to this script:

index=_internal user_account_control_property.py log_level=ERROR

topic Streamed Search Execute Failed Because: Error in 'lookup' command in Splunk Search

Streamed Search Execute Failed Because: Error in 'lookup' command

Re: Streamed Search Execute Failed Because: Error in 'lookup' command