♌💓💓
Hello friends,
In order to run a query starting with a pipeline (|) in the run query action of the Splunk App on SOAR version 6.4, you need to prepend an index and hostname that do not actually exist.
Example:
index=not hostname=not append [ | inputlookup ... | eval command=... ]
This way, the query will execute correctly even though the main logic begins with a pipeline.
.
