All Apps and Add-ons

Error on maclookup command -- netaddr not found.

nysdanharrison
Engager

Trying to use the maclookup command offline and getting the error:
command="maclookup",: failed to use the netaddr module!
Using version 2.5.2 to TA-maclookup on splunk 7.2.5.1. Have installed the python netaddr module on the system python and have rebooted, still not working. Works in online mode, but that's not a long-term solution that will work in our enviornment.

chris
Motivator

We have the same issue. I think the problem is, that the TA is not designed to fail in a safe way. The error you see in the ui is rather generic.

You can easily change the behaviour by editing the maclookup.py file.

        except Exception as e:
            logger.error( 'failed to use the netaddr module!' )

            #splunk.Intersplunk.generateErrorResults(': failed to use the netaddr module!')
            #exit()

            line['vendor']="not found"
            line['maclookup_error']=str(e)
            list.append(line)

You will get a hint about the error in the maclookup_error field, if the lookup is not succesful in offline mode.
@MuS: You wouldn't happen to have time to change the behaviour?

Regards
Chris

MuS
SplunkTrust
SplunkTrust

Sorry I missed that question in the first place 😞

I will have a look today

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Updated version on https://github.com/M-u-S/TA-maclookup available, apps.splunk.com will take a few hours/days 😉

cheers, MuS

chris
Motivator

Thank you.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.