Splunk SOAR

How to do hint and input validation for custom field in phantom

Qingguo
Engager

when inputing a customer field of data/time in container,  is there any ways to do hints of input and input validation  ? 

Currently it only support text/select in 4.10.X in customer field ,   and it is not real-time if done by playbook or some action.

Labels (1)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@Qingguo at the moment the only way to control this is to have a playbook with a prompt for the person inputting the time stamp, then you can validate the prompt entry with a little bit of custom code in the playbook. If valid, add to the custom_field else either ask again in the same playbook or fail and inform the user that they inputted an incorrect date and they should re-run the playbook. 

I have done this at a few customers now. 

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...