Splunk SOAR (f.k.a. Phantom)

SPLUNk SOAR- Splunk Run query

harishlnu
Engager

Hi Team,

Could you please help me on running query in Splunk,
The query starts with | ldapsearch.

run query only have command search,tstats,eval,savedsearch,stats

Could you please guide me on this

Thanks in advance

 

Regards,

Harisha

 

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@harishlnu just leave the command field empty and put the full SPL in the query field and it will work. It may complain about the command field not being populated but IMO that was a silly addition to the app action.

-- Hope this helps! If it does please mark as a solution for the future. Happy SOARing! --

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@harishlnu just leave the command field empty and put the full SPL in the query field and it will work. It may complain about the command field not being populated but IMO that was a silly addition to the app action.

-- Hope this helps! If it does please mark as a solution for the future. Happy SOARing! --

0 Karma

harishlnu
Engager

It worked Thank you @phanTom 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...