{"action":"created","issue":{"url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/43","labels_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/43/comments","events_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/43/events","html_url":"https://github.com/micheloosterhof/cowrie/issues/43","id":107875343,"number":43,"title":"Cowrie and Tango splunk app","user":{"login":"bernardoortega","id":14553095,"avatar_url":"https://avatars.githubusercontent.com/u/14553095?v=3","gravatar_id":"","url":"https://api.github.com/users/bernardoortega","html_url":"https://github.com/bernardoortega","followers_url":"https://api.github.com/users/bernardoortega/followers","following_url":"https://api.github.com/users/bernardoortega/following{/other_user}","gists_url":"https://api.github.com/users/bernardoortega/gists{/gist_id}","starred_url":"https://api.github.com/users/bernardoortega/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bernardoortega/subscriptions","organizations_url":"https://api.github.com/users/bernardoortega/orgs","repos_url":"https://api.github.com/users/bernardoortega/repos","events_url":"https://api.github.com/users/bernardoortega/events{/privacy}","received_events_url":"https://api.github.com/users/bernardoortega/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-23T08:54:54Z","updated_at":"2015-09-25T07:38:13Z","closed_at":null,"body":"Hello\r\n\r\nI have managed to modify the Tango app for splunk to be able to get the logs from cowrie, instead of kippo. I would appreciate some help for the virus total API. I have added the API according to instructions and installed request on Splunk server but do not know about this VT command on the dashboards, etc. Any help?\r\n\r\nThanks"},"comment":{"url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/comments/143150086","html_url":"https://github.com/micheloosterhof/cowrie/issues/43#issuecomment-143150086","issue_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/43","id":143150086,"user":{"login":"bernardoortega","id":14553095,"avatar_url":"https://avatars.githubusercontent.com/u/14553095?v=3","gravatar_id":"","url":"https://api.github.com/users/bernardoortega","html_url":"https://github.com/bernardoortega","followers_url":"https://api.github.com/users/bernardoortega/followers","following_url":"https://api.github.com/users/bernardoortega/following{/other_user}","gists_url":"https://api.github.com/users/bernardoortega/gists{/gist_id}","starred_url":"https://api.github.com/users/bernardoortega/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bernardoortega/subscriptions","organizations_url":"https://api.github.com/users/bernardoortega/orgs","repos_url":"https://api.github.com/users/bernardoortega/repos","events_url":"https://api.github.com/users/bernardoortega/events{/privacy}","received_events_url":"https://api.github.com/users/bernardoortega/received_events","type":"User","site_admin":false},"created_at":"2015-09-25T07:38:13Z","updated_at":"2015-09-25T07:38:13Z","body":"Hello\r\n\r\nIs good to know that you guys are working on the splunk app for cowrie. Let me know if you would like to see my modificatiosn on all the dashboards to have cowrie sending logs.\r\n\r\nWhen doing the VirusTotal lookup, i get an error:\r\n\r\nError in 'script': Getinfo probe failed for external search command 'vt'\r\n\r\nIf i go to the log file in the job inspector i see this:\r\n\r\nINFO  script - found script file=/opt/splunk/etc/apps/tango/bin/vt.py\r\n09-25-2015 07:37:03.143 INFO  script - stderr for script vt will be treated as search messages\r\n09-25-2015 07:37:03.221 WARN  SearchResults - Corrupt csv header, 2 columns with the same name 'Unknown' (col #3 and #0, #3 will be ignored)\r\n09-25-2015 07:37:03.221 WARN  SearchResults - Corrupt csv header, 2 columns with the same name 'Unknown' (col #4 and #0, #4 will be ignored)\r\n09-25-2015 07:37:03.221 ERROR script - Getinfo probe failed for external search command 'vt'\r\n\r\nany ideas?\r\n\r\nthanks\r\n\r\n\r\n"}}