topic Re: send to soar inactive in ACTION in Splunk Enterprise https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755480#M23467 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/314206">@dragon</a>&nbsp;</P><P>Do you get anything if you run the following in SPL?</P><LI-CODE lang="markup">| rest /servicesNS/nobody/phantom/target_list_ar</LI-CODE><P><span class="lia-unicode-emoji" title=":glowing_star:">🌟</span><SPAN>&nbsp;</SPAN><STRONG>Did this answer help you?</STRONG><SPAN>&nbsp;</SPAN>If so, please consider:</P><UL><LI>Adding karma to show it was useful</LI><LI>Marking it as the solution if it resolved your issue</LI><LI>Commenting if you need any clarification</LI></UL><P>Your feedback encourages the volunteers in this community to continue contributing</P> Thu, 13 Nov 2025 15:29:06 GMT livehybrid 2025-11-13T15:29:06Z send to soar inactive in ACTION https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755458#M23460 <P>Hello guys.</P><P>I'm having a problem right now.</P><P>SOAR : 192.168.100.120 (on-prem, Ver 7)</P><P>Splunk Enterprise : 192.168.100.128 (on-prem, Ver 10)</P><P>&nbsp;</P><P>I'll tell you a few things I've done so far.</P><P>1. Install SOAR App, Connected to SOAR, Created Indexes</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="dragon_1-1763000363907.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/40814i7B3D84CA1FD4D0F7/image-size/medium?v=v2&amp;px=400" role="button" title="dragon_1-1763000363907.png" alt="dragon_1-1763000363907.png" /></span></P><P>&nbsp;</P><P>2. also, The connection test from SOAR to Enterprise also went smoothly.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="dragon_2-1762998986134.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/40812i548B8B4E1DE2A577/image-size/medium?v=v2&amp;px=400" role="button" title="dragon_2-1762998986134.png" alt="dragon_2-1762998986134.png" /></span></P><P>3. user prev</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="dragon_0-1763000346317.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/40813i1764DF17BFFCCCB5/image-size/medium?v=v2&amp;px=400" role="button" title="dragon_0-1763000346317.png" alt="dragon_0-1763000346317.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>However, when I set ‘Send to SOAR’ as an Action in Splunk, the button doesn't activate.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="dragon_0-1762995723655.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/40810i011F097BDB2E2263/image-size/medium?v=v2&amp;px=400" role="button" title="dragon_0-1762995723655.png" alt="dragon_0-1762995723655.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>Did I miss anything?</P><P>&nbsp;</P> Thu, 13 Nov 2025 02:19:30 GMT https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755458#M23460 dragon 2025-11-13T02:19:30Z Re: send to soar inactive in ACTION https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755480#M23467 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/314206">@dragon</a>&nbsp;</P><P>Do you get anything if you run the following in SPL?</P><LI-CODE lang="markup">| rest /servicesNS/nobody/phantom/target_list_ar</LI-CODE><P><span class="lia-unicode-emoji" title=":glowing_star:">🌟</span><SPAN>&nbsp;</SPAN><STRONG>Did this answer help you?</STRONG><SPAN>&nbsp;</SPAN>If so, please consider:</P><UL><LI>Adding karma to show it was useful</LI><LI>Marking it as the solution if it resolved your issue</LI><LI>Commenting if you need any clarification</LI></UL><P>Your feedback encourages the volunteers in this community to continue contributing</P> Thu, 13 Nov 2025 15:29:06 GMT https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755480#M23467 livehybrid 2025-11-13T15:29:06Z Re: send to soar inactive in ACTION https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755558#M23480 <P>no I dont have any results...</P><P>&nbsp;</P><P>but I solved it. thanks</P><P>&nbsp;</P><P>first. install both app (SOAR, SOAR EXPORT)</P><P>second. setting BOTH OF ALL...</P> Mon, 17 Nov 2025 00:50:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/send-to-soar-inactive-in-ACTION/m-p/755558#M23480 dragon 2025-11-17T00:50:15Z