Splunk SOAR

Error adding External Splunk Enterprise Instance to SOAR

JAvnaim
Explorer

Hello,

I am attempting to add an External Splunk Enterprise Instance to SOAR and receive the following error when I click "Test connection":

 

ss1.png

 I am running Splunk Enterprise On-Prem v8.2.9, Splunk App for SOAR 1.0.41, and SOAR (Unprivileged, On-prem) v6.0.0.114895. What's interesting is I can see the events be created in Splunk Enterprise in the phantom_action_run index:

ss2.png

 Does anyone happen to know what the (not very descriptive) error "status" means? Whats also interesting is none of my hosts are named "Splunk", so wondering where the error is pulling that hostname from?

 

Thanks ahead of time for your help!

 

~J

 

 

 

Labels (2)
0 Karma
1 Solution

JAvnaim
Explorer

Thanks @phanTom  for the quick reply!

 

Your response made perfect sense to me; however I have validated:

  • I was able to log into Splunk Enterprise as phantomdelete
  • As phantomdelete, I was able to "delete" events (using "| delete" in a search) - is there another way I should be testing to delete events?
  • Validate the events are no longer shown in the search
  • Logged back into SOAR and after pressing "Test Connection", the same error as noted above is shown.

 

Thinking there was something wrong with the phantomdelete user, I removed the account from Splunk Enterprise and recreated it (using a different name). Oddly enough, after recreating it, and testing it again in SOAR, I am greeted with "Test Successful"! So weird, but now my SOAR and Splunk Enterprise appear connected.

 

Thanks for your help!

 

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@JAvnaim this error usually relates to the phantomdelete user you need to create, not having the correct permissions OR the "must reset password on 1st login" is still ticked on the account. 

Test you can log into the account using the same password you put in the config and also check it can delete events. 

If you don't want the delete capability you can remove from the phantomdelete user once this has been setup and linked. 

 

-- Hope this helps! If so please mark as the solution to future viewers! Happy SOARing! --

JAvnaim
Explorer

Thanks @phanTom  for the quick reply!

 

Your response made perfect sense to me; however I have validated:

  • I was able to log into Splunk Enterprise as phantomdelete
  • As phantomdelete, I was able to "delete" events (using "| delete" in a search) - is there another way I should be testing to delete events?
  • Validate the events are no longer shown in the search
  • Logged back into SOAR and after pressing "Test Connection", the same error as noted above is shown.

 

Thinking there was something wrong with the phantomdelete user, I removed the account from Splunk Enterprise and recreated it (using a different name). Oddly enough, after recreating it, and testing it again in SOAR, I am greeted with "Test Successful"! So weird, but now my SOAR and Splunk Enterprise appear connected.

 

Thanks for your help!

 

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...