I am trying to query a Splunk search head using the Splunk connector from SOAR. However, my playbook is giving an error in the action block with the below error: Failed to connect to splunk server. HTTP Error 400: Bad Request (1235) There are no issues of connectivity as I have tested the connectivity to our asset in the app and it has passed successfully. Yet, my playbook is failing with the above error. My playbook design consists of a format block that formats the simple SPL query as : |makeresults|eval id="This is a test" |eval playbook="App upgrade splunk"|table _time id playbook which is referenced in the action block that queries a Splunk Search Head using the Splunk app. Any advise on the possible issue is much appreciated ? Thanks in advance
... View more