Splunk app for Phantom supports running a query on Splunk. I am trying to use foreach in my query, but the action fails with an error | foreach x_* [ eval f_{<<FIELD>>}=if(isnotnull('<<FIELD>>'),1,null()) ] The error I get is Fri Nov 01 2019 17:15:01 GMT+1100 (Australian Eastern Daylight Time): phantom.format(): Unexpected error in format(): Traceback (most recent call last): File "../pylib/phantom/rules.py", line 1119, in format File "../pylib/phantom/rules.py", line 188, in encode_all_parameters File "../pylib/phantom/rules.py", line 1257, in expand_template_ KeyError: '<<FIELD>>' Fri Nov 01 2019 17:15:01 GMT+1100 (Australian Eastern Daylight Time): '<<FIELD>>' Any ideas how to get this through. I tried writing an expanded version of the foreach, i.e. | eval f_{x_0}=if(isnotnull(x_0), 1, null())... but that also failed with Fri Nov 01 2019 17:19:23 GMT+1100 (Australian Eastern Daylight Time): phantom.format(): Unexpected error in format(): Traceback (most recent call last): File "../pylib/phantom/rules.py", line 1119, in format File "../pylib/phantom/rules.py", line 188, in encode_all_parameters File "../pylib/phantom/rules.py", line 1257, in expand_template_ KeyError: 'x_0' Fri Nov 01 2019 17:19:23 GMT+1100 (Australian Eastern Daylight Time): 'x_0' ... View more

I am using eventgen to generate transaction type data, where I create an event in Splunk and then at some point in the future, I create a new event to revoke the initial event. It works like this my first event is using a guid in the event a saved search runs periodically and searches for a select set of these events and writes the guids to an outputlookup this csv is then used by another eventgen sample to create the second revocation transaction However, it seems that as eventgen randomises the replacement file at startup, when the saved search rewrites the outputlookup, eventgen is not aware of that change, so will continue to use the file. This means that the same guid can be potentially reused in (2) and new guids created in (1) are not candidates. I can see this in the log file Normalized replacement file /opt/splunk/etc/apps/app/lookups/guids.csv is there a way to force this to refresh? ... View more

I have a number of saved searches scheduled to run each morning. However, I have a dashboard that allows certain configuration items to be changed in the app, which then would require those saved searched to run as the previous results are now invalid. I am using | savedsearch xxx in my dashboard, but that only runs the saved search, it does not update the previously cached result set. I cannot find a way for me to force a 'scheduled' run of those searches so the results are then saved for the next 24 hours. In the past, I have manually updated the scheduled time to be a few minutes in the future, wait for the searches to run, and then set the schedule times back to their original time, but with about 10 saved searches, and the app deployed on a client site, that's not practical. Any idea how to do this? ... View more