Not a stupid question at all 🙂 I mean the transforms.conf for the threathunting app itself in 'etc\apps\threathunting' ... View more

I can't claim to be an expert in this, but I believe I found the issue. This most likely only occurs on Windows installations of Splunk. When you set a proxy in the script it reads from apps\virustotalchecker\local\vtc.conf, the python script is expecting a section header of [settings] to be at the start of this file. However: At the start of the file there is a new line (so the script doesn't find the section header); The vtc.conf file is encoded with UTF-8 and the python script isn't decoding it; These two reasons are why \xef\xbb\xbf\n is being returned to the script instead of [settings] Doing the following fixed it for me: 1. Open the vtc.conf file in local; 2. Delete the newline at the start of the file, so [settings] is on line 1; 3. Change the encoding of the file to ANSI from UTF-8 (you can do this easily in Notepad++. Hopefully the author will update the script to deal with this issue. ... View more