Splunk Dev

Virustotal Splunk Cloud error

sumanssah
Communicator

Getting error while performing below mentioned search

_ index=symantec sourcetype=sep12:risk NOT actual_action= "Details pending" dest_nt_host=* | table dest hash_value | vt field="hash_value"_

Search Factory: Unknown search command 'vt'.

0 Karma

sumanssah
Communicator

Check if you have required app installed on Splunk Cloud search-head, looks you are referring to

VirusTotal Malware Lookup for Splunk: https://splunkbase.splunk.com/app/4283

If not, raise a request for Splunk support for app installation.

0 Karma

Bloodnite
Path Finder

you likely need to set the commands.conf value to point to the app's python file, or you're not searching within the app

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...