I`m trying to run a search using dnslookup.
index=MY_INDEX host=MY_HOST
| lookup dnslookup clienthost as host output clientip as ip_address
I run the search from one of my SH and from my Indexers and It runs successfully. But when the search runs in my other SH, I got the errors below:
[INDEXER_1] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.
[INDEXER_1] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.
[INDEXER_2] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.
[INDEXER_2] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.
[INDEXER_3] Could not find 'external_lookup.py'. It is required for lookup 'dnslookup'.
[INDEXER_3] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'dnslookup' does not exist or is not available.
All the configuration files in both Search Heads are the same. Does anyone have any tips about this issue?
