Trying to use the maclookup command offline and getting the error:
command="maclookup",: failed to use the netaddr module!
Using version 2.5.2 to TA-maclookup on splunk 18.104.22.168. Have installed the python netaddr module on the system python and have rebooted, still not working. Works in online mode, but that's not a long-term solution that will work in our enviornment.
We have the same issue. I think the problem is, that the TA is not designed to fail in a safe way. The error you see in the ui is rather generic.
You can easily change the behaviour by editing the maclookup.py file.
except Exception as e:
logger.error( 'failed to use the netaddr module!' )
#splunk.Intersplunk.generateErrorResults(': failed to use the netaddr module!')
You will get a hint about the error in the maclookup_error field, if the lookup is not succesful in offline mode.
@MuS: You wouldn't happen to have time to change the behaviour?