Splunk Phantom
Highlighted

Forwarding Splunk events to Phantom automatically

Explorer

Hi ,

I have integrated splunk with Phantom and can send the events to phantom by clicking on send to Phantom button. But I have scheduled search to send the events to Phantom whenever there is any. However I dont see any events sent to Phantom . I checked the logs, didnt find any error too. Please guide .

Thanks,

Labels (2)
0 Karma
Highlighted

Re: Forwarding Splunk events to Phantom automatically

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Forwarding Splunk events to Phantom automatically

Explorer

Hi David @DavidHourani,
yes I have setup the alerts based on this doc. But facing this issue. Manual clicking on send to phantom works fine. But schedule and automatically sending the results to phantom is not working.

Thanks

0 Karma
Highlighted

Re: Forwarding Splunk events to Phantom automatically

SplunkTrust
SplunkTrust

Did you check internal phantom logs and/or scheduler. Have a look at index=_internal yourSavedSearchName and see if the action field is triggering when it comes to the saved search you're running.

0 Karma
Highlighted

Re: Forwarding Splunk events to Phantom automatically

Communicator

If you can, share the screenshot of the configuration that you have done

0 Karma
Highlighted

Re: Forwarding Splunk events to Phantom automatically

Explorer

Thank you .
I see no errors but I see resultcount = 0 in the logs alertactions=""

When I manually run that command or refresh the page after I click on recent results, it shows me the results in search bar. I tried putting that in admin user also. Didnt work.

Phantom configuraiton is working fine as I can send the results by clickind on send to phantom.

Found another way to do it by trigger action . Thats working fine. But with Savesearch Export using phantom app is not working .

0 Karma
Highlighted

Re: Forwarding Splunk events to Phantom automatically

Communicator
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.