Splunk Phantom

Unable to see events in splunk phantom

bhavneeshvohra
Loves-to-Learn Lots

Hi all,
I am very new to phantom. Its my first time dealing with it.
I was trying to connect splunk instance to phantom. Following things worked fine:-
1. installed Splunk app for phantom
2. made server configurations with phantom.

Now i made a saved search to send the data to phantom.
Using the event forwarding-> new saved search.
--> I selected my saved search , destination, enabled auto extracted fields and clicked on save.

Now i am able to view events in splunk but i could not see any events in phantom.

PLease help its very urgent...

Thanks in advance!!!

Labels (2)
0 Karma

ansusabu
Communicator

Have you configured 'Phantom app for Splunk'? If not, this is not going to work. Another option for you is that you can use 'Splunk App for Phantom' to poll the events from Splunk using the same splunk query.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!