topic Re: SplunkPy Integration in Cortex XSOAR Discussions

SplunkPy Integration

YilmazDincer — Tue, 30 Jan 2024 21:10:16 GMT

Hi everyone,
I get data from splunk with the "search index=notable" query using Splunkpy. I assign the incoming data to the type named Splunk Generic Notable by default. Here, when an incident occurs, there are fields such as event_code, process_name in "labels". But on the mapper page, the label section comes empty. This data appears in _raw (in mapping page, but in incident page, data appears in labels and _raw). I want to assign some of these fields to incident fields, but I can't do it, where is the problem? What do I need to edit?

Re: SplunkPy Integration

RahulVijaydev — Wed, 31 Jan 2024 20:00:53 GMT

Hello,

Labels constitute all the unmapped data, meaning, if a field in the alert JSON is not mapped to an XSOAR field, the value ends up as a label.

You can use filters and transformers to extract fields from _raw and map them to XSOAR fields in the mapper.

Thanks,

Rahul Vijaydev

Re: SplunkPy Integration

B.Tran881425 — Wed, 28 May 2025 18:03:12 GMT

Hello,
I am new to Cortex XSOAR. I am trying to integrate XSOAR and Splunk Enterprise Security.

what is SplunkPy? is SplunkPy part of the XSOAR apps? or Splunk Apps? where can I get SplunkPy?

thank you

Re: SplunkPy Integration

jason_blackburn — Tue, 07 Oct 2025 19:57:30 GMT

I installed the SplunkPy integration from the marketplace within XSOAR