Splunk Enterprise

Forward Events into Phantom

New Member

I am currently using Splunk Enterprise 8.0.3 and Phantom version 4.8.24304. All Phantom apps have been installed and are configured correctly.

In Splunk Web, I have successfully configured the Phantom Server in the App, and applied the Splunk Enterprise instance IP under the "allowed ips" in Phantom.

I have tried two ways of forwarding data into Phantom from Splunk; through the event forwarding of saved searches and through the HTTP Event Collector (HEC). Splunk Web and Phantom are on two different VM, I am not able to connect utilizing the HEC in Phantom under the Search Settings option, and the saved search for event forwarding never appears in Phantom.

For the HEC, I used the following URL: hxxp://splunk_host:8088/services/collector/event .  Each time whether using http or https, the request 404's out.

The saved search function allows me to choose to "Send to Phantom", but again I am not seeing any events in Phantom.  I have verified connectivity between the VM's and there are no issues there. The problem lies somewhere with my HEC and the saved searches for forwarding.

My VM is listening on port 8088 for HEC.

Any help would be greatly appreciated.

Labels (2)
Tags (1)
0 Karma


Hello @mripp ,

The "Send to Phantom" only works with with Enterprise Security currently.
We have to use the script phantom_forward.py even though scripts are deprecated. $SPLUNK_HOME/etc/apps/phantom/bin/scripts/phantom_forward.py is the location of the script.
You should be able to see it if you select the alert option for a script while in the Splunk Add-on for Phantom app.

Our problem is currently with the phantom.conf replication causing Splunk SH Clustering issues when a real-time search is running. It replicates across the cluster so often that it causes baseline and snapshot replication problems.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...