Hi,
I'm a newbie to splunk and need your help here.
I have installed virustotal checker and ran a query to list down the hash value. But when running it im getting an error. PFB
My Query
INdex=AV | table dhost Message_id | vt field="Message_id" | table dhost Message_id vt_* .
Error message:
External search command 'vt' returned error code 1. Script output = " ERROR "MissingSectionHeaderError at ""C:\Program Files\Splunk\etc\apps\virustotalchecker\bin\virustotalchecker.py"", > line 92 : File contains no section >headers. file: C:\Program > Files\Splunk\etc/apps/virustotalchecker/local/vtc.conf, line: 1 '\xef\xbb\xbf\n'" "
Im not sure whether i have configured the virustotal cecker in right manner. Any help will be appreciated.
I can't claim to be an expert in this, but I believe I found the issue. This most likely only occurs on Windows installations of Splunk.
When you set a proxy in the script it reads from apps\virustotalchecker\local\vtc.conf, the python script is expecting a section header of [settings] to be at the start of this file. However:
These two reasons are why \xef\xbb\xbf\n is being returned to the script instead of [settings]
Doing the following fixed it for me:
1. Open the vtc.conf file in local;
2. Delete the newline at the start of the file, so [settings] is on line 1;
3. Change the encoding of the file to ANSI from UTF-8 (you can do this easily in Notepad++.
Hopefully the author will update the script to deal with this issue.