https://community.splunk.com/t5/Splunk-SOAR/How-do-I-perform-field-mapping-between-Splunk-and-Phantom-when/m-p/382803#M18 <P>Hello, </P> <P>I am using the action Run playbook in Phantom. Splunk can send the alert, but without fields created on Splunk. I have created the same fields on Phantom but the mapping was not performed.</P> Thu, 14 Feb 2019 10:55:36 GMT fati_ben_soar 2019-02-14T10:55:36Z https://community.splunk.com/t5/Splunk-SOAR/How-do-I-perform-field-mapping-between-Splunk-and-Phantom-when/m-p/382803#M18 <P>Hello, </P> <P>I am using the action Run playbook in Phantom. Splunk can send the alert, but without fields created on Splunk. I have created the same fields on Phantom but the mapping was not performed.</P> Thu, 14 Feb 2019 10:55:36 GMT https://community.splunk.com/t5/Splunk-SOAR/How-do-I-perform-field-mapping-between-Splunk-and-Phantom-when/m-p/382803#M18 fati_ben_soar 2019-02-14T10:55:36Z https://community.splunk.com/t5/Splunk-SOAR/How-do-I-perform-field-mapping-between-Splunk-and-Phantom-when/m-p/382804#M19 <P>Using the Phantom App for Splunk would be recommended for performing field mappings in that way:<BR /> <A href="https://splunkbase.splunk.com/app/3411/">https://splunkbase.splunk.com/app/3411/</A></P> <P>You can utilize either a Saved Search or Data Model to have events from Splunk Core/ES which meet the defined criteria in your SPL forwarded to the Phantom instance of your choice:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6535i4F2D0803B946515B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 29 Aug 2019 06:32:02 GMT https://community.splunk.com/t5/Splunk-SOAR/How-do-I-perform-field-mapping-between-Splunk-and-Phantom-when/m-p/382804#M19 cblumer_splunk 2019-08-29T06:32:02Z