Splunk Search

how to search for search queries triggered from Phantom in splunk cloud

ravivarmagv1
Loves-to-Learn

Hello All,

I am new to splunk and looking for suggestion on search queries. In our environment, we have phantom app installed and fetches data from splunk cloud. Recently we have OOM event in splunk cloud and found that search queries triggered by phantom are consuming high memory and i have been asked to investigate the issue. As part of investigation, i want to list all search queries triggered by phantom in splunk and analyze query that is consuming high memory.

Can you please help me with a search query to search in splunk to extract all search queries triggered by phantom playbook/use cases. Thanks in Advance!!

Labels (1)
Tags (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!