Splunk SOAR (f.k.a. Phantom)

Forwarding Splunk events to Phantom automatically

rishma
Explorer

Hi ,

I have integrated splunk with Phantom and can send the events to phantom by clicking on send to Phantom button. But I have scheduled search to send the events to Phantom whenever there is any. However I dont see any events sent to Phantom . I checked the logs, didnt find any error too. Please guide .

Thanks,

Labels (2)
0 Karma

ansusabu
Communicator
0 Karma

DavidHourani
Super Champion
0 Karma

rishma
Explorer

Hi David @DavidHourani,
yes I have setup the alerts based on this doc. But facing this issue. Manual clicking on send to phantom works fine. But schedule and automatically sending the results to phantom is not working.

Thanks

0 Karma

ansusabu
Communicator

If you can, share the screenshot of the configuration that you have done

0 Karma

rishma
Explorer

Thank you .
I see no errors but I see result_count = 0 in the logs alert_actions=""

When I manually run that command or refresh the page after I click on recent results, it shows me the results in search bar. I tried putting that in admin user also. Didnt work.

Phantom configuraiton is working fine as I can send the results by clickind on send to phantom.

Found another way to do it by trigger action . Thats working fine. But with Savesearch Export using phantom app is not working .

0 Karma

DavidHourani
Super Champion

Did you check internal phantom logs and/or scheduler. Have a look at index=_internal yourSavedSearchName and see if the action field is triggering when it comes to the saved search you're running.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.