Splunk SOAR

Issue to Map fields between QRadar and Phantom

flogo
New Member

Hello,

I'm using the QRadar integration on Phantom, and we can define the mapping between Phantom and QRadar.
I got an issue when i tried to map fields, so the map works correctly for generic field (QID, username, sourceip, etc...) and Custom Fields that doesn't containing space character, for example "EventID". But when i tried to map custom field that contain a space character like "Domain Name", the mapping doesn't work.
Someone got the same issue than me ?

Thank you in advance,
Regards,
Florian

Labels (1)
Tags (3)
0 Karma

kyung123a
New Member

Comma separated list of field names. Shouldn't double quotes be used if the field name contains spaces?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...