Issue with Ingesting Splunk Notable Events into Splunk SOAR – Missing Fields like event_id

[sgote]

Hello Team,

I’ve been trying to ingest Splunk notable events into Splunk SOAR (Phantom), but I’m facing an issue where not all details are being transferred automatically. I’ve experimented with multiple methods, including:

1. Using the "Send to Adaptive Response" option with "Send to SOAR."
2. Utilizing the Splunk App for SOAR Export.(Forwording)
3. Installing the Splunk App directly on my Splunk SOAR instance.(on poll)

During the application configuration, I enabled the polling option, and data is being ingested through both methods. However, critical fields like event_id and others are missing in the ingested data. Interestingly, when I manually select the "Send to SOAR" option under a notable event, all fields are successfully transferred to SOAR without any issues.

Is there a way to automate the process so that all details, including event_id and other fields, are sent to SOAR consistently? I’ve also attached a screenshot for reference to help clarify the issue.


Manually send sieam to soar:
manually send to soar.png

 On poll using :

on poll data.png

[SOARt_of_Lost]

My organization ran into a similar issue when we were initially deploying SOAR - we think it was due to our notable events having too many characters and then the entire message getting truncated.

We ended up creating "One Notable to Rule them All" - just a notable that looks for other notables - it also removes fields we don't care about, ignores all suppressed events, and a few other pieces that make sense for our environment. We then also set the alert actions on this notable itself.