This app has been replaced by CAVE Detective, which also has support for Virus Total. https://splunkbase.splunk.com/app/4213/ This app provides a SPL command (| opendns) to query the Investigate API provided by OpenDNS. You must have a valid API key from OpenDNS in order for this App to work. Once the data is queried from the Investigate API, it's stored in the opendns_cache KV Store configured by this App.