I want to use whois lookup with clientip, but I can't get any information with a command like the following
"... | lookup whois host as client_ip | table _time, client_ip, asn_cidr, network.name, whois_server, path, user_id, status_code"
The following error appears in the search log.
Does anyone know the cause of this error?
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': Exception in thread ping_lookup: 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': Traceback (most recent call last): 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\Python-3.7\lib\threading.py", line 926, in _bootstrap_inner 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': self.run() 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\Python-3.7\lib\threading.py", line 870, in run 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': self._target(*self._args, **self._kwargs) 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\custom_lookup.py", line 253, in do_lookup 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': self.execute_lookup(result, w, fieldnames) 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\custom_lookup.py", line 210, in execute_lookup 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': output = self.do_lookup(**keyword_arguments) 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py", line 55, in do_lookup 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': index = get_default_index() 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\__init__.py", line 133, in get_default_index 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': app_config = get_app_config(session_key) 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\__init__.py", line 106, in get_app_config 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': conf = ConfigParser.SafeConfigParser() 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': AttributeError: type object 'ConfigParser' has no attribute 'SafeConfigParser'