https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503174#M8919 <P>Ideally this would occur as the result of a user entering data into a dashboard. So, there is not really an event occurring. I am not sure we need to store the entered data in an index.</P> Thu, 26 Mar 2020 17:25:29 GMT DanEhrlich 2020-03-26T17:25:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503172#M8917 <P>Is there a way to create a container in Phantom using results from a Splunk search?</P> Thu, 26 Mar 2020 12:33:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503172#M8917 DanEhrlich 2020-03-26T12:33:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503173#M8918 <P>The Splunk app for Phantom can poll Splunk and create containers. Alternatively, the Phantom App for Splunk can be configured to send events from Splunk to Phantom.</P> <P>See:<BR /> <A href="https://splunkbase.splunk.com/app/3411/">https://splunkbase.splunk.com/app/3411/</A><BR /> <A href="https://my.phantom.us/4.8/docs/app_reference/phantom_splunk">https://my.phantom.us/4.8/docs/app_reference/phantom_splunk</A></P> Thu, 26 Mar 2020 17:14:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503173#M8918 sam_splunk 2020-03-26T17:14:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503174#M8919 <P>Ideally this would occur as the result of a user entering data into a dashboard. So, there is not really an event occurring. I am not sure we need to store the entered data in an index.</P> Thu, 26 Mar 2020 17:25:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Creating-phantom-containers-from-a-splunk-search/m-p/503174#M8919 DanEhrlich 2020-03-26T17:25:29Z