Salam Splunkers, i'm experiencing an issue with the Splunk app after upgrading our Splunk SOAR platform to version 8.4. When testing the connection from the Splunk app, the test fails with the following error: App 'Splunk' started successfully (id: 1784368063970) on asset: 'splunk'(id: 17) Loaded action execution configuration 1 action failed Traceback (most recent call last): File "/opt/phantom/splunk-soar/apps/splunk_91883aa8-9c81-470b-97a1-5d8f7995f560/dependencies/python3.13/soar_sdk/decorators/test_connectivity.py", line 56, in inner result = function(**kwargs) File "/opt/phantom/splunk-soar/apps/splunk_91883aa8-9c81-470b-97a1-5d8f7995f560/src/app.py", line 736, in test_connectivity helper.validate_asset() ~~~~~~~~~~~~~~~~~~~~~^^ File "/opt/phantom/splunk-soar/apps/splunk_91883aa8-9c81-470b-97a1-5d8f7995f560/src/app.py", line 273, in validate_asset raise ValueError(SPLUNK_ERR_REQUIRED_CONFIG_PARAMS) ValueError: Please provide either API token or username and password in the asset configuration parameters for authentication Traceback (most recent call last): File "/opt/phantom/splunk-soar/apps/splunk_91883aa8-9c81-470b-97a1-5d8f7995f560/dependencies/python3.13/soar_sdk/decorators/test_connectivity.py", line 56, in inner result = function(**kwargs) File "/opt/phantom/splunk-soar/apps/splunk_91883aa8-9c81-470b-97a1-5d8f7995f560/src/app.py", line 736, in test_connectivity helper.validate_asset() ~~~~~~~~~~~~~~~~~~~~~^^ File "/opt/phantom/splunk-soar/apps/splunk_91883aa8-9c81-470b-97a1-5d8f7995f560/src/app.py", line 273, in validate_asset raise ValueError(SPLUNK_ERR_REQUIRED_CONFIG_PARAMS) ValueError: Please provide either API token or username and password in the asset configuration parameters for authentication The complete traceback indicates that the validation fails in helper.validate_asset() during the Test Connectivity action. We have already verified the following: • Configured the asset using username and password.. • Configured the asset using an API token generated from a Splunk Enterprise administrator account.. • Saved the asset configuration before running the test.. • The same asset configuration worked correctly on SOAR 7.x prior to upgrading.. The issue started only after upgrading to Splunk SOAR 8.4. Could you please advise whether this is a known issue with the Splunk app or SOAR 8.4? If there are any compatibility requirements, patches, or additional troubleshooting steps, please let us know. Environment: • Splunk SOAR: 8.4.0.166. Thank you for your assistance. ... View more

Salam Splunkers, I’m having a problem while configuring the Windows Remote Management app with the Splunk SOAR platform. When testing the connectivity with the transport type set to NTLM, it fails and displays an error message. Following the error message, I disabled FIPS mode on the Windows Server and tested the connectivity again, but the issue persists. I then changed the transport type to Kerberos, but ran into a different issue. I have a  few questions: Is the targeted system for integration with this app the Windows Server or the Windows\Linux endpoint? Do we need to integrate the Windows Server itself in order to access the endpoints listed under the AD domain of that Windows Server with this app? Any guidance would be appreciated! ... View more

What is the reason that Splunk UBA Kafka  give me this error, how can i fix this Kafka topics are not receiving events and Kafka Broker ... View more

Salam guys I wrote the Correlation Search Query and added the Adaptive Response Actions (notable, risk analysis and send to soar), but when the event goes to soar there's no event_id in the artifacts SPL Query: [ | tstats summariesonly=true values("Authentication.user") as "user",values("Authentication.dest") as "dest",count("Authentication.dest") as "dest_count",count("Authentication.user") as "user_count",count from datamodel="Authentication"."Authentication" where nodename="Authentication.Failed_Authentication" by "Authentication.src","Authentication.app" | rename "Authentication.src" as "src","Authentication.app" as "app" | where 'count'>5 ] ... View more

Hi guys  when I extract a selected event it doesn't show all data in event that I need to extracted ... View more

how can I make the Splunk agent collect the web Brower or network logs from Endpoint (windows, Linux) to the Splunk Server  ... View more

In Splunk ES and the platform, this error keeps appearing and I couldn't resolve it. Could not load lookup=LOOKUP-useragentstrings ... View more

Why does the Approval settings work in some actions and not in others? ... View more

Hi everyone, Is there a way to speed up the Splunk SOAR capabilities to process the events, it can't process a 100 events every 5 minutes....  I found a solution about the worker but, the file that solution talk about doesn't exists which is "umsgi.ini" ... View more

is there playbook for this kind of thing? playbook "user password policy enforcement " ... View more

How can SOAR be set up to receive data from Splunk ES, process it, send an action to the endpoints, and update the event status in Splunk ES? ... View more