Splunk App for Phantom Reporting

VijaySrrie — Fri, 29 Oct 2021 08:13:57 GMT

Hi Team,

Splunk App for Phantom Reporting

Testing 1 :

If HEC token is created in HF, Indexes are created in Indexer, Roles/User/splunk app for phantom reporting app is created in SH ---> In phantom Side - If I give the host as (HF IP) --> It is not working

(Getting error as)
Test connection failed. Test connection failed for phantomsearch on host "Splunk": No results found.

Testing 2:

If indexes are created in Indexer, HEC token/user/roles/splunk app for Phantom reporting app is created in SH --> In phantom side --> If I give the host as (SH IP) --> It is working (But it is not accepted as best practice)

Testing 3:

Indexes/HEC token/user/role is created in Indexer and splunk app for phantom reporting app is created in SH, In Phantom end --> If I give the host as (Indexer IP) ---> It is working (This is also not accepted as best practice)

What should I do to make my Testing 1 work?

topic Splunk App for Phantom Reporting in Getting Data In

Splunk App for Phantom Reporting

Splunk App for Phantom Reporting