Hi I am new to Splunk Phantom and have so far far
I can see that i can use the Splunk App in Phantom and use the postdata command.
However i only seem to be able to sned back one value at a time, with no futher remarks.Is it possible to send back the complete object from Phantom into Splunk as a JSON object?
For example you would have the original data you sent to Phantom and then the enhancement that you have got from running the playbook against the original data.
The reason is that Splunk is the front end tool, and it would be more convienient to view any results in Splunk.
You can use format block for formatting data and that formatted data can be used to post in SPlunk