topic SPLUNk SOAR- Splunk Run query in Splunk SOAR

SPLUNk SOAR- Splunk Run query

harishlnu — Thu, 25 Apr 2024 15:09:34 GMT

Hi Team,

Could you please help me on running query in Splunk,
The query starts with | ldapsearch.

run query only have command search,tstats,eval,savedsearch,stats

Could you please guide me on this

Thanks in advance

Regards,

Harisha

Re: SPLUNk SOAR- Splunk Run query

phanTom — Thu, 25 Apr 2024 15:25:21 GMT

@harishlnu just leave the command field empty and put the full SPL in the query field and it will work. It may complain about the command field not being populated but IMO that was a silly addition to the app action.

-- Hope this helps! If it does please mark as a solution for the future. Happy SOARing! --

Re: SPLUNk SOAR- Splunk Run query

harishlnu — Thu, 25 Apr 2024 15:46:43 GMT

It worked Thank you @phanTom