Not getting result of splunk query in xsoar

Himangi — Fri, 24 Feb 2023 06:29:32 GMT

I am trying one splunk query to fetch some result in xsoar using automation splunk-search, but I am not getting any result in xsoar whereas for the same query I am getting result in splunk, can anyone please help, below is the query:

index=cbuae_windows | search host IN(${incident.destinationhostname}) | stats values(Account_Domain) as Account_Domain,values(Account_Name) as Account_Name,values(EventCode) as EventCode,values(dest_nt_domain) as dest_nt_domain,values(signature) as signature,values(dest) as dest,earliest(_time) as earliest,latest(_time) as latest by user,src_user,action,host

Re: Not getting result of splunk query in xsoar

Joesephtorres — Thu, 30 Mar 2023 20:30:10 GMT

If certain Splunk apps have access to certain indexes you may have to define the Splunk app to use within the playbook task.

topic Re: Not getting result of splunk query in xsoar in Cortex XSOAR Discussions

Not getting result of splunk query in xsoar

Re: Not getting result of splunk query in xsoar