Hello All,
I am new to splunk and looking for suggestion on search queries. In our environment, we have phantom app installed and fetches data from splunk cloud. Recently we have OOM event in splunk cloud and found that search queries triggered by phantom are consuming high memory and i have been asked to investigate the issue. As part of investigation, i want to list all search queries triggered by phantom in splunk and analyze query that is consuming high memory.
Can you please help me with a search query to search in splunk to extract all search queries triggered by phantom playbook/use cases. Thanks in Advance!!
