All Apps and Add-ons

AbuseIPdb_check syntax and usage- Help with AbuseePDB API key

cybermonday
Explorer

The Splunk app AbuseIPdb_check (https://splunkbase.splunk.com/app/4903) is not working as expected after copying the config.json file to this app's local directory and putting my AbuseIPDB API key.


I have tried with syntax as below - 

| makeresults | eval ip="94.201.237.206" | abuseip ipfield=ip

| makeresults | eval ip="94.201.237.206" |abuseip(ip)



The error on Splunk web is -- Error in 'script': Get info probe failed for external search command 'abuseip'. 

i did not find anything relevant as a pointer when checked in Splunk _internal logs for this. 

Under all configuration "abuseip" is mentioned as config type - command with enabled status and global sharing permissions. 

 

Has it worked for anyone? any direction/solution pointer would be appreciable.  

Labels (1)
0 Karma

theSOCguy
Explorer

I am having the same issue. Can't seem to find a solution for this one yet. 

0 Karma

code_assassin
Explorer

I'm having similar issues, however strangely enough there are a few times where the script actually works. 
Here is the command that worked (works randomly) for me:

syntax = | abuseip ipfield=<insert field name> 
example = | abuseip ipfield=destip

As far as the error goes, I was able to find these two sources but non of them helped. Might help you out. 
https://community.splunk.com/t5/Security/getinfo-probe-failed-for-external-search-command-a-rights-i... 
https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Custom-command-Getinfo-probe-failed... 

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...