Streamed Search Execute Failed Because: Error in 'lookup' command

[JoshuaJJ]

Good morning, 

I am having issues with admon and running into this error: 

Streamed Search Execute Failed Because: Error in 'lookup' command: Script execution failed for external search command '/opt/splunk/var/run/searchpeers/B3E####/apps/Splunk_TA_Windows/bin/user_account_control_property.py'..

Transforms on indexer 

#########Active Directory ##########

[user_account_control_property]

external_cmd = user_account_control_property.py userAccountControl userAccountPropertyFlad

external_type = python

field_list = userAccountControl, userAccountPropertyFlag

python.version = python3 

Script is located within the bin directory of the App .../bin/user_account_control_property

The error is happening when I run this search      index=test source=ActiveDirectory

I have an app created called ADMON on the deployment server which is being deployed to my primary domain controllers. At first, I saw a ton of sync data, after that it was erroring out with the above error message.

[marnall]

At first glance it seems your field/argument "userAccountPropertyFlag" ends with a 'd' character when passed to the script: "userAccountPropertyFlad"

If that doesn't fix it, you may be able to find more informational errors by searching in the internal error logs relating to this script:

index=_internal user_account_control_property.py log_level=ERROR