All Apps and Add-ons

AbuseIPdb_check syntax and usage


The Splunk app AbuseIPdb_check ( is not working as expected after copying the config.json file to this app's local directory and putting my AbuseIPDB API key.

I have tried with syntax as below - 

| makeresults | eval ip="" | abuseip ipfield=ip

| makeresults | eval ip="" |abuseip(ip)

The error on Splunk web is -- Error in 'script': Get info probe failed for external search command 'abuseip'. 

i did not find anything relevant as a pointer when checked in Splunk _internal logs for this. 

Under all configuration "abuseip" is mentioned as config type - command with enabled status and global sharing permissions. 


Has it worked for anyone? any direction/solution pointer would be appreciable.  

Labels (1)
0 Karma