If you're not using Splunk Enterprise Security, then there is no Notable ID to send to Phantom. In this case, if you're just using Splunk Enterprise (core), you can use an Adaptive Response action that is provided with the Phantom app for Splunk (https://splunkbase.splunk.com/app/3411/) to forward your alerts. You can choose either "Send to Phantom" or "Run Playbook in Phantom". The documentation is at https://my.phantom.us/4.2/docs/admin/splunk ... View more

there is a similar question with a good answer https://answers.splunk.com/answers/204452/change-user-default-home-dashboard.html ... View more

I had the same problem and this worked for me: - name: Create a hec token uri: url: https://localhost:8089/servicesNS/nobody/your_app/data/inputs/http?output_mode=json user: admin password: your_password method: POST body_format: form-urlencoded body: - [ name, token_name ] - [ index, your_index ] - [ sourcetype, your_sourcetype ] ... View more