All Apps and Add-ons

AbuseIPdb_check syntax and usage- Help with AbuseePDB API key

cybermonday
Explorer

The Splunk app AbuseIPdb_check (https://splunkbase.splunk.com/app/4903) is not working as expected after copying the config.json file to this app's local directory and putting my AbuseIPDB API key.


I have tried with syntax as below - 

| makeresults | eval ip="94.201.237.206" | abuseip ipfield=ip

| makeresults | eval ip="94.201.237.206" |abuseip(ip)



The error on Splunk web is -- Error in 'script': Get info probe failed for external search command 'abuseip'. 

i did not find anything relevant as a pointer when checked in Splunk _internal logs for this. 

Under all configuration "abuseip" is mentioned as config type - command with enabled status and global sharing permissions. 

 

Has it worked for anyone? any direction/solution pointer would be appreciable.  

Labels (1)
0 Karma

theSOCguy
Explorer

I am having the same issue. Can't seem to find a solution for this one yet. 

0 Karma

code_assassin
Explorer

I'm having similar issues, however strangely enough there are a few times where the script actually works. 
Here is the command that worked (works randomly) for me:

syntax = | abuseip ipfield=<insert field name> 
example = | abuseip ipfield=destip

As far as the error goes, I was able to find these two sources but non of them helped. Might help you out. 
https://community.splunk.com/t5/Security/getinfo-probe-failed-for-external-search-command-a-rights-i... 
https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Custom-command-Getinfo-probe-failed... 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...