All Apps and Add-ons

AbuseIPdb_check syntax and usage- Help with AbuseePDB API key

cybermonday
Explorer

The Splunk app AbuseIPdb_check (https://splunkbase.splunk.com/app/4903) is not working as expected after copying the config.json file to this app's local directory and putting my AbuseIPDB API key.


I have tried with syntax as below - 

| makeresults | eval ip="94.201.237.206" | abuseip ipfield=ip

| makeresults | eval ip="94.201.237.206" |abuseip(ip)



The error on Splunk web is -- Error in 'script': Get info probe failed for external search command 'abuseip'. 

i did not find anything relevant as a pointer when checked in Splunk _internal logs for this. 

Under all configuration "abuseip" is mentioned as config type - command with enabled status and global sharing permissions. 

 

Has it worked for anyone? any direction/solution pointer would be appreciable.  

Labels (1)
0 Karma

theSOCguy
Explorer

I am having the same issue. Can't seem to find a solution for this one yet. 

0 Karma

code_assassin
Explorer

I'm having similar issues, however strangely enough there are a few times where the script actually works. 
Here is the command that worked (works randomly) for me:

syntax = | abuseip ipfield=<insert field name> 
example = | abuseip ipfield=destip

As far as the error goes, I was able to find these two sources but non of them helped. Might help you out. 
https://community.splunk.com/t5/Security/getinfo-probe-failed-for-external-search-command-a-rights-i... 
https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Custom-command-Getinfo-probe-failed... 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...