Splunk Search

how to search for search queries triggered from Phantom in splunk cloud

ravivarmagv1
Loves-to-Learn

Hello All,

I am new to splunk and looking for suggestion on search queries. In our environment, we have phantom app installed and fetches data from splunk cloud. Recently we have OOM event in splunk cloud and found that search queries triggered by phantom are consuming high memory and i have been asked to investigate the issue. As part of investigation, i want to list all search queries triggered by phantom in splunk and analyze query that is consuming high memory.

Can you please help me with a search query to search in splunk to extract all search queries triggered by phantom playbook/use cases. Thanks in Advance!!

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...