Error Script execution failed for external search command "MAC Adress Vendor"

[TISKAR]

Hello Splunker,

I'l tryin to use application to search Vendor

I installed the application MAC Address Vendor Lookup for Splunk (https://splunkbase.splunk.com/app/4308/) to recover the Vendor based on the MAC address, but I find the following error.

[Indexer1] Script execution failed for external search command '/opt/splunk/var/run/searchpeers/SH-XXXXXX/apps/TA-mac-address-vendor-lookup/bin/mac_vendor_lookup.py' . 

Info:

1. The application is installed in Search Head.
2. I have a cluster mode

Can you help please.

Thank you 🙂

[richgalloway]

Install the app on your indexers.

[TISKAR]

@richgalloway Thank you for this respence.

In my case i sante use the appas in SH to create report, this app is used like lookup:

my search
| lookup (python apps lookup)

[richgalloway]

It will depend on what exactly is in my search, but the lookup command probably executes on the indexers, which means the TA must be there as well.
If you want to force the lookup to execute on the search head, use this query:

my search
| lookup local=true (python apps lookup)