Non Enterprise Security Splunk users

[tommy.johansson]

Hi

Please share some info on how you are running your setup.

We are currently using the TA-Demisto splunk app to push the alerts to the XSOAR but having issues with excessive incidents in XSOAR being created when we use the |table in our searches and havent been able to figure this out.

Thanks in advance for tips and tricks on this subject.

[asawyer]

Hi @tommy.johansson – Our recommendation is to use the XSOAR SplunkPy integration, rather than the add-on. Please see the instructions here for how to set up and use the integration for a Splunk non-Enterprise Security environment: https://xsoar.pan.dev/docs/reference/integrations/splunk-py#splunk-non-enterprise-security-users