SplunkPy Integration

[YilmazDincer]

Hi everyone,
I get data from splunk with the "search index=notable" query using Splunkpy. I assign the incoming data to the type named Splunk Generic Notable by default. Here, when an incident occurs, there are fields such as event_code, process_name in "labels". But on the mapper page, the label section comes empty. This data appears in _raw (in mapping page, but in incident page, data appears in labels and _raw). I want to assign some of these fields to incident fields, but I can't do it, where is the problem? What do I need to edit?

[RahulVijaydev]

Hello,

Labels constitute all the unmapped data, meaning, if a field in the alert JSON is not mapped to an XSOAR field, the value ends up as a label.

You can use filters and transformers to extract fields from _raw and map them to XSOAR fields in the mapper.

Thanks,

Rahul Vijaydev