Error on maclookup command -- netaddr not found.

[nysdanharrison]

Trying to use the maclookup command offline and getting the error:
command="maclookup",: failed to use the netaddr module!
Using version 2.5.2 to TA-maclookup on splunk 7.2.5.1. Have installed the python netaddr module on the system python and have rebooted, still not working. Works in online mode, but that's not a long-term solution that will work in our enviornment.

[chris]

We have the same issue. I think the problem is, that the TA is not designed to fail in a safe way. The error you see in the ui is rather generic.

You can easily change the behaviour by editing the maclookup.py file.

        except Exception as e:
            logger.error( 'failed to use the netaddr module!' )

            #splunk.Intersplunk.generateErrorResults(': failed to use the netaddr module!')
            #exit()

            line['vendor']="not found"
            line['maclookup_error']=str(e)
            list.append(line)

You will get a hint about the error in the maclookup_error field, if the lookup is not succesful in offline mode.
@MuS: You wouldn't happen to have time to change the behaviour?

Regards
Chris

[MuS]

Sorry I missed that question in the first place 😞

I will have a look today

cheers, MuS

[MuS]

Updated version on https://github.com/M-u-S/TA-maclookup available, apps.splunk.com will take a few hours/days 😉

cheers, MuS

[chris]

Thank you.