Splunk SOAR

How to troubleshoot playbook issue where the wrong raw log is being included in the ticket?

brandylee1993
Explorer

How can I Troubleshoot playbook issue where the wrong raw log is being included in the ticket.
For example, where ticket was created for source IP 10.xx.x.xxx and destination IP 10.x.x.x- however the raw log was for source IP 10.35.41.10, and destination IP was 10.1.3.7.

Labels (1)
Tags (2)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

I believe when you send an event to Splunk Phantom the complete results file will be forwarded to Phantom, the result may contain more than one result from same search job. This could be one of the reason.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...