SA-SPLICE: Why am I getting "message from "python /opt/splunk/etc/apps/SA-Splice/bin/taxii.py" ERRORNo default database defined"?

[chrisomar]

Hello team,

I'm trying to get SPLICE working in Splunk, however, it's complaining about default database defined. Can someone please point me out to the right direction here.

thanks.

[cleroux_splunk]

did you ran the setup to configure the mongo URI ? Everything you need should be in the embedded docs.

[chrisomar]

i did run config and i did configure the URI but I'm not sure how this works? the URI is for the mongoDB server IP? or where to poll the IOCs from the tool?

A little background, i have mongoDB in a different server - not in the search head like the docs recommend. I don't know how the communication work between the mongoDB, splunk and the tool where the IOCs are located. if you can help me understand that flow will be great.

thanks and I'm sorry for my novice in this regards.