Splunk Enterprise Security

How to invoke adhoc queries

pcyr
Engager

After installing and configuring this application I am unable to get the adaptive response to run. I continue to get teh error as follows:
" "Shodan IP Lookup" could not be dispatched: ModularActionException: Invalid parameter for ad hoc modular action."

Is there a format which is needed when invoking this adaptive response directly from the event and manually placing the IP into the IP lookup field? Thank you.

0 Karma

dperre_splunk
Splunk Employee
Splunk Employee

Hey pcyr. Do you have Splunk Add-on for CIM installed?
Another got you is that you need to go into the index settings and select an index and press save

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...