This section provides guidance on how to diagnose and resolve common issues when using the vt command from the VirusTotal App for Splunk. When the vt command is executed in an SPL search, it always returns a field named vt_result in the output.

• If the command completes successfully, the value of vt_result will be: success
  
  
  
  
  

• If the command fails, vt_result will contain an error message describing the reason for the failure.

Common errors include

• Incorrect API Token configuration
  This occurs when the API Token is missing, invalid or incorrectly copied. The app is unable to authenticate against the VirusTotal API, causing the request to fail.
  Example:
  
  
  
  
• Incorrect Proxy configuration
  Triggered when the proxy settings (protocol, host, or port) are incorrect or point to a server that cannot be reached from the Splunk environment. As a result, the request cannot be routed properly.
  Example:
  
  
  
  
• Proxy requiring authentication (username/password)
  If the environment uses a proxy that requires authentication, but the app is not configured with a username and password, the proxy rejects the request, preventing communication with VirusTotal.
  Example:
  
  
  
  
• Network issues or timeout during the request
  Caused by general connectivity issues such as firewall restrictions, DNS problems, high latency, slow proxy response, or temporary outages. The request exceeds the timeout threshold or cannot reach the VirusTotal API.
  Example: