Hello All -
Using version 1.7.6 on Splunk Enterprise 8.2.3:
Search Error:
Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'.
| tstats summariesonly=t count from datamodel=Web WHERE (*) sourcetype="websense:cg:kv" Web.mid IN (*) Web.id IN (*) Web.user IN ("**") Web.action IN ("*") Web.src IN ("**") Web.status IN ("*") Web.http_method IN ("*") Web.category IN ("*") Web.dest IN ("***") Web.http_user_agent IN ("**") by Web.http_user_agent | rename Web.* as * | stats sum(count) as "count" by http_user_agent | lookup user_agents http_user_agent | table count ua_family http_user_agent | sort 0 -count
From Job Inspector:
08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': File "/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py", line 54 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': results = user_agent_parser.Parse(http_user_agent) 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': ^ 08-30-2022 14:30:38.150 ERROR ScriptRunner [53774 StatusEnforcerThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py http_user_agent ua_os_family ua_os_major ua_os_minor ua_os_patch ua_os_patch_minor ua_family ua_major ua_minor ua_patch ua_device': TabError: inconsistent use of tabs and spaces in indentation 08-30-2022 14:30:38.153 ERROR ExternalProvider [53774 StatusEnforcerThread] - Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'. 08-30-2022 14:30:38.153 ERROR SearchStatusEnforcer [53774 StatusEnforcerThread] - StatusEnforcerThread failed with error: Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'. 08-30-2022 14:30:38.153 INFO ReducePhaseExecutor [53774 StatusEnforcerThread] - ReducePhaseExecutor=1 action=CANCEL 08-30-2022 14:30:38.153 INFO DispatchExecutor [53774 StatusEnforcerThread] - User applied action=CANCEL while status=0 08-30-2022 14:30:38.153 ERROR SearchStatusEnforcer [53774 StatusEnforcerThread] - sid:_amFzb25faG90Y2hraXNzQGFvLnVzY291cnRzLmdvdg_amFzb25faG90Y2hraXNzQGFvLnVzY291cnRzLmdvdg_bmxzX1VJX2Rldg__search32_1661869827.397931_B7BA11EF-467A-4E74-B057-FC9CAC03F269 Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/etc/apps/TA-user-agents/bin/user_agents.py'.
Any suggestions on how to fix this? Thank you.
That's a coding error. Contact the app developer via the app's Splunkbase page.