In 4.3 Getting "error code 1" messages when trying to do an external lookup with a Python Script. Script runs ok standalone and of course takes user as it's argument.
~|lookup ad_info_lookup user OUTPUT ad_info
external mysql db
Try checking user's timezone settings. That's what caused external scripts to fail in my case
bl01:~/etc/searchscripts$ python ad_info_lookup.py user ad_info < /home/jnich/test.csv
user,ad_info
jnic,
jchiap,
iskell,
cat first, questions later:
splunk@seca01:~/etc/searchscripts$ cat /home/jnichols/test.csv |python ad_info_lookup.py user ad_info
user,ad_info
jnic,Security Infrastructure
jchiap,Security Assurance
iskell,Security Assurance