I am not using an api key, just free tier.
I get this error when used in search:
External search command 'ipextrainfo' returned error code 1. Script output = "error_message=TypeError at "/opt/splunk/etc/apps/ip_extrainfo/bin/ipextrainfo.py", line 47 : 'Message' object is not subscriptable ".
Hi @mikefg
Despite this being usable without an API Key, it seems that the code is expecting an empty value for the API Key if you are using the free tier. I found the same issue as you when installing the app, to fix the issue I set the API key to a random value (e.g abc), then hit Save API Key.
Then once saved click the Reset API Key button.
After this the command works 🙂
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
Getting a new error after trying your idea.
New error:
Expecting value: line 1 column 1 (char 0)
my search string:
index=network | ipextrainfo ip=src_ip | table src_ip country
Hi @mikefg
Please can you run the below SPL and make sure if returns an empty string?
| inputlookup ipapikey | sort - savetime | head 1 | table apikey
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
Empty string.
Oh thats annoying - let me have another test to see what I can find.