I've got a question about lookup tables, and how to audit them. I have a rather large lookup table that's being recreated daily from a scheduled correlation search. I don't know if any other correlation searches or anything is actually using that lookup table. I wanted to see if there was a way to audit it's use so I can delete the table, and remove the correlation search if needed. ... View more

Howdy, I'm building out some alerting in Splunk ES, and created a new correlation search. That is all working, but I'm unable to pass my eval as a value into email alert. What I have: | eval alert_message=range.":".sourcetype." log source has not checked in ".'Communicated Minutes Ago'." minutes. On index=".index.". Latest Event:".'Latest Event' | table alert_message Just running the search works, the table is there and looks correct. I've tried variations of $alert_message$ with and without quotes, but the alert_message never gets passed to the email alert. I haven't tried to generate a notable, but I'm guessing I'll have the same issue. I feel like I'm missing something easy here... ... View more

Pretty green with SOAR and haven't been able to find an good answer to this. All of our events in SOAR are generated by pulling them in from Splunk ES.  This creates one artifact for each event.  I'm looking for a way to extract data from that artifact so we can start using and labeling that data. Am I missing something here?  I haven't found much in the way of training on the data extraction part of this, so any tips for that would be great too.   ... View more