Trying to use the maclookup command offline and getting the error:
command="maclookup",: failed to use the netaddr module!
Using version 2.5.2 to TA-maclookup on splunk 7.2.5.1. Have installed the python netaddr module on the system python and have rebooted, still not working. Works in online mode, but that's not a long-term solution that will work in our enviornment.
We have the same issue. I think the problem is, that the TA is not designed to fail in a safe way. The error you see in the ui is rather generic.
You can easily change the behaviour by editing the maclookup.py file.
except Exception as e:
logger.error( 'failed to use the netaddr module!' )
#splunk.Intersplunk.generateErrorResults(': failed to use the netaddr module!')
#exit()
line['vendor']="not found"
line['maclookup_error']=str(e)
list.append(line)
You will get a hint about the error in the maclookup_error field, if the lookup is not succesful in offline mode.
@MuS: You wouldn't happen to have time to change the behaviour?
Regards
Chris
Sorry I missed that question in the first place 😞
I will have a look today
cheers, MuS
Updated version on https://github.com/M-u-S/TA-maclookup available, apps.splunk.com will take a few hours/days 😉
cheers, MuS
Thank you.