Splunk Search

Network toolkit - whois lookup: attribute error

Tomioka
New Member

I want to use whois lookup with clientip, but I can't get any information with a command like the following
"... | lookup whois host as client_ip | table _time, client_ip, asn_cidr, network.name, whois_server, path, user_id, status_code"

The following error appears in the search log.

Does anyone know the cause of this error?

12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':  Exception in thread ping_lookup:
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':  Traceback (most recent call last):
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\Python-3.7\lib\threading.py", line 926, in _bootstrap_inner
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      self.run()
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\Python-3.7\lib\threading.py", line 870, in run
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      self._target(*self._args, **self._kwargs)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\custom_lookup.py", line 253, in do_lookup
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      self.execute_lookup(result, w, fieldnames)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\custom_lookup.py", line 210, in execute_lookup
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      output = self.do_lookup(**keyword_arguments)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py", line 55, in do_lookup
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      index = get_default_index()
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\__init__.py", line 133, in get_default_index
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      app_config = get_app_config(session_key)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':    File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\__init__.py", line 106, in get_app_config
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':      conf = ConfigParser.SafeConfigParser()
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host':  AttributeError: type object 'ConfigParser' has no attribute 'SafeConfigParser'

 

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...