Splunk SOAR (f.k.a. Phantom)

[Phantom] Looped Splunk Run Query action able to display results

carl72086
Explorer

Hi There,

Below is the logic I am trying to achieve:

Perform enrichment on a list of host via information extraction using a Spunk's run query action. The resulting results will then be added as an artifact.

1. Get  List of Hosts and run each one of them against step 2.
2. Run a Splunk query which aims to get the host info (e.g. ldap details)
3. Extract the details from the splunk query and add an artifact.
4. Loop until steps 2-4 until the all the host in the list has been processed.

Issue:

The first loop is working fine, I am able to successfully run the query, extract the fields and place them in a format block and then add them as an artifact.

The problem comes in the succeeding searches, the splunk searches appears to be successful, but the resulting data is not passed properly, the value appears to show as None.

Note that the same format block works for every first time you run the playbook.

Another thing to note is that i am using a Join Function and using the built in add artifact action.

Cheers,
Carl

 

 

 

 

Labels (1)
0 Karma
1 Solution

carl72086
Explorer

Update:  Managed to figure this out after tons of testing. If you have multiple queries (e.g. splunk queries) inside a join loop, you need to be able to save the query result data and the easiest way to do that without having to add artifacts is to create a custom function after each query and pass the data (via custom function input an output). In that way you can call the custom function outputs at the end of the playbook and be able to format it as needed.

View solution in original post

0 Karma

carl72086
Explorer

Update:  Managed to figure this out after tons of testing. If you have multiple queries (e.g. splunk queries) inside a join loop, you need to be able to save the query result data and the easiest way to do that without having to add artifacts is to create a custom function after each query and pass the data (via custom function input an output). In that way you can call the custom function outputs at the end of the playbook and be able to format it as needed.

0 Karma

prasanthkota
Engager

Hello,

 

I am trying to create the custom code but no luck is it possible to share the custom code you have created so i can have modify it?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...