Error with python scripts in Hurricane Labs app for Shodan

[brandonleiker]

Getting an error with python scripts as shown below.

The SA-shodan add-on is installed and I do have an API key for Shodan.

Have tried configuring with single IP address X.X.X.X as well as range in CIDR format X.X.X.X/24

command="inputjson", Traceback (most recent call last): File "E:\Program Files\Splunk\etc\apps\Hurricane_Labs_App_for_Shodan\bin\inputjson.py", line 24, in <module> main() File "E:\Program Files\Splunk\etc\apps\Hurricane_Labs_App_for_Shodan\bin\inputjson.py", line 17, in main raise ValueError(sys.argv[1]) ValueError: shodan/my_subnets.json

[rdaul]

I faced the same error at some point but after trying few things it was error free.

Try configuring with just a single public ip, 4.2.2.1 and manually run the following commands:

On search add-on for Hurricane labs app:
| shodan 4.2.2.1
If this returns result then your API key is working.

Next manually run this on Search app:
| shodan [| inputlookup shodan_my_subnets | fields ipAddress | rename ipAddress as net] | outputjson shodan/my_subnets.json

This will manually run the search and provide results.

[thambisetty]

this is not working at all.

[brandonleiker]

The Search Add-On is installed; still seeing the same error and the script should have ran at least 5 times by this point in time.

[mcmaster]

Brandon -

As noted on the app page, you'll need to either manually run the saved search that comes with the app, or wait for it to run on its own, to populate that JSON file. Once the search runs once, it will run on its own every 12 hours to cache the latest Shodan data, so that you don't use API credits every time the dashboard loads. Also, make sure you have the Hurricane Labs Search Add-On for Shodan (https://splunkbase.splunk.com/app/1766/) installed as well.

Let me know if that helps or if you still have issues. I'm interested to know how well the app works on Windows