I've written an external lookup script that makes a rest call to an API & returns data. The API destination requires going through a firewall, so we are only allowing our search head to make the call.
When I use the lookup using tstats on the search head, the lookup executes very quickly. When I use it against searches that pull data from our indexers, the indexers appear to be running the script. This fails, however, due to the firewall not being open for the script to run.
I have local=true set on the lookup command, and also used localop
Search:
| head 1 | localop | lookup local=true XXXX fieldA | table fieldA,lookupvalue
From the search inspector:
This search has completed and has returned 1 result by scanning 671 event in 1,141.566 seconds.
Error message in the search inspector for every indexer:
Script for lookup table 'XXXX' returned error code 1. Results may be incorrect.
Any suggestions? My next step is to block replication of this to indexers.
