Error during script lookup in macro

[strive]

Hi,

In one of my macros, i lookup a python script. I am getting the following error.

Script for lookup table 'mypythonscript' returned error code 1. Results may be incorrect.

My macro is:

First part of macro | lookup mypythonscript clientip as ClientIP output client_city as City | Third part of macro

Our application is deployed in virtual machines. In one setup we are not facing this error, where as in other we are facing this error.

Could you please let me know what is the root cause for this error and how to resolve it.

Thanks

Strive

[alacercogitatus · Accepted solution]

Sounds like a problem within python installed on the system. I don't know the root cause but you can check the python by running (replace variables/paths as fits your environment):

$SPLUNK_HOME/bin/splunk cmd python /path/to/apps/myapp/bin/mypythonscript.py

If that executes correctly, then it should execute correctly during the search. If there is a typo, the script will error out and give you the specifics.