Using Splunk Phantom post data to send data from Phantom back into Splunk

[davidwaugh]

Hi I am new to Splunk Phantom and have so far far

• Triggered an alert in Splunk
• This send the data into Phantom
• Phantom then runs a playbook which queries some Carbon Black stuff
• I then want to send the results of this carbon black search back into Splunk

I can see that i can use the Splunk App in Phantom and use the postdata command.

However i only seem to be able to sned back one value at a time, with no futher remarks.
Is it possible to send back the complete object from Phantom into Splunk as a JSON object?

For example you would have the original data you sent to Phantom and then the enhancement that you have got from running the playbook against the original data.

The reason is that Splunk is the front end tool, and it would be more convienient to view any results in Splunk.

[ansusabu]

You can use format block for formatting data and that formatted data can be used to post in SPlunk