All Apps and Add-ons

AbuseIPdb_check syntax and usage- Help with AbuseePDB API key

cybermonday
Explorer

The Splunk app AbuseIPdb_check (https://splunkbase.splunk.com/app/4903) is not working as expected after copying the config.json file to this app's local directory and putting my AbuseIPDB API key.


I have tried with syntax as below - 

| makeresults | eval ip="94.201.237.206" | abuseip ipfield=ip

| makeresults | eval ip="94.201.237.206" |abuseip(ip)



The error on Splunk web is -- Error in 'script': Get info probe failed for external search command 'abuseip'. 

i did not find anything relevant as a pointer when checked in Splunk _internal logs for this. 

Under all configuration "abuseip" is mentioned as config type - command with enabled status and global sharing permissions. 

 

Has it worked for anyone? any direction/solution pointer would be appreciable.  

Labels (1)
0 Karma

theSOCguy
Explorer

I am having the same issue. Can't seem to find a solution for this one yet. 

0 Karma

code_assassin
Explorer

I'm having similar issues, however strangely enough there are a few times where the script actually works. 
Here is the command that worked (works randomly) for me:

syntax = | abuseip ipfield=<insert field name> 
example = | abuseip ipfield=destip

As far as the error goes, I was able to find these two sources but non of them helped. Might help you out. 
https://community.splunk.com/t5/Security/getinfo-probe-failed-for-external-search-command-a-rights-i... 
https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Custom-command-Getinfo-probe-failed... 

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...