i just updated my app with a new version. i have configured a new start dashboard which includes already some simple xml reports. there you can easily review how the reports are working and customize them with your own needs.
The predefinied dashboards are filtered down to eventtype="honeypotappevents" - this means you need to Tag your log source of which you want to see your data and enrich those.
to verify if you ip reputation lookup is working, you need to do the following:
Create some Field Extractions with IP's and name the fields "clientip"
Search for some periode of time like clientip=* | lookup threatscore clientip
Verify if there is a new field called "threatscore" within the "interesting fields"
The filtering was added to avoid that if you click on your dashboard the lookup is starting across all your it-data. the lookup is going via DNS Requests - and if Splunk runs for thousands of IP's a dns query you can imagine what happens to your DNS Server 😉 so use it only on data which you're really interested.