Splunk SOAR (f.k.a. Phantom)

for how much time events are stored in the server?

meshorer
Path Finder

hello all!

is there a default time that events (containers/cases) are stored in the SOAR server to approach to?

and if so, can I change the time?

@phanTom 

Thank you in advance

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @meshorer,

Splunk SOAR keeps event, containers, etc. on its database up to database size limit. You can delete them according to your retention needs.

Please see https://docs.splunk.com/Documentation/SOARonprem/6.2.0/Admin/DeleteContainers

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

H, @meshorer,

Yes, rest/health endpoint shows db_data and status off all services.

https://docs.splunk.com/Documentation/SOARonprem/6.2.0/PlatformAPI/RESTInfo#.2Frest.2Fhealth 

But maybe it is better to monitor the system using an external script or something else. This will alert you even system stops.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @meshorer,

Since your events could not be written to db, service would stop. That is why you should monitor system health.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

meshorer
Path Finder

hi @scelikok ,

understood, thank you.

I would love to hear from you how you recommend to monitor system health.

I thought of rest call "health" in a playbook to run every few minuets.

if you have another idea, please do tell 🙂

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @meshorer,

Splunk SOAR keeps event, containers, etc. on its database up to database size limit. You can delete them according to your retention needs.

Please see https://docs.splunk.com/Documentation/SOARonprem/6.2.0/Admin/DeleteContainers

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

meshorer
Path Finder

hi @scelikok 

 

so what happens when I reach the size limit in my server?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...