I am trying to query a Splunk search head using the Splunk connector from SOAR. However, my playbook is giving an error in the action block with the below error:
Failed to connect to splunk server. HTTP Error 400: Bad Request (1235)
There are no issues of connectivity as I have tested the connectivity to our asset in the app and it has passed successfully.
Yet, my playbook is failing with the above error.
My playbook design consists of a format block that formats the simple SPL query as :
|makeresults|eval id="This is a test" |eval playbook="App upgrade splunk"|table _time id playbook
which is referenced in the action block that queries a Splunk Search Head using the Splunk app.
Any advise on the possible issue is much appreciated ?
Thanks in advance
