I want to use whois lookup with clientip, but I can't get any information with a command like the following "... | lookup whois host as client_ip | table _time, client_ip, asn_cidr, network.name, whois_server, path, user_id, status_code" The following error appears in the search log. Does anyone know the cause of this error? 12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': Exception in thread ping_lookup:
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': Traceback (most recent call last):
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\Python-3.7\lib\threading.py", line 926, in _bootstrap_inner
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': self.run()
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\Python-3.7\lib\threading.py", line 870, in run
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': self._target(*self._args, **self._kwargs)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\custom_lookup.py", line 253, in do_lookup
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': self.execute_lookup(result, w, fieldnames)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\custom_lookup.py", line 210, in execute_lookup
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': output = self.do_lookup(**keyword_arguments)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py", line 55, in do_lookup
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': index = get_default_index()
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\__init__.py", line 133, in get_default_index
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': app_config = get_app_config(session_key)
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': File "C:\Program Files\Splunk\etc\apps\network_tools\bin\network_tools_app\__init__.py", line 106, in get_app_config
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': conf = ConfigParser.SafeConfigParser()
12-27-2020 15:52:21.672 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\Python3.exe C:\Program Files\Splunk\etc\apps\network_tools\bin\whois_lookup.py host': AttributeError: type object 'ConfigParser' has no attribute 'SafeConfigParser'
... View more