Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information. Update May 5, 2017 Update Mar 8, 2016


A python script that can be used by a Splunk custom command to query the API. If you have any comments or suggestions please raise an issue and I'll get back to you.


  1. Splunk 6.0+
  2. Internet connection


  1. Add the following to your Splunk apps $SPLUNK_HOME/etc/apps/<app_name>local/commands.conf
filename =
  1. Add to $SPLUNK_HOME/etc/apps/<app_name>/bin/


To query an IP

From Splunk search run | cymon __EXECUTE__ | spath input=cy

To query a domain

From Splunk search run | cymon __EXECUTE__ | spath input=cy

Format JSON resonse as a table
| cymon __EXECUTE__ "" | spath input=cy | rename results{}.* AS * | eval x = mvzip(title, description) 
| eval x = mvzip(x, details_url, ",")
| eval x = mvzip(x, created, ",") 
| eval x = mvzip(x, updated, ",")
| eval x = mvzip(x, tag, ",")
| mvexpand x | makemv delim="," x 
| eval title=mvindex(x,0) 
| eval description=mvindex(x,1) 
| eval details_url=mvindex(x,2) 
| eval created=mvindex(x,3) 
| eval updated=mvindex(x,4)
| eval tag=mvindex(x,5)
| table title, created, updated, tag, description, details_url


  • Add support for API keys.
  • Add support for domain queries.

Used a one or two line snippet of another script but can't remember where I found it from. Shoutout to Craig B for pointing out an install guide error.