Configure the service with Splunk App for SOAR

To configure remote search using Splunk App for SOAR, you must configure the app on your Splunk search heads or search head clusters as well as on your indexers.

Obtain a Splunk Cloud Platform or Splunk Enterprise license

You need a Splunk Cloud Platform or Splunk Enterprise license to use external Splunk Cloud Platform or Splunk Enterprise with Splunk SOAR. If you don't already have a Splunk Cloud Platform or Splunk Enterprise license, work with your delivery team to purchase one.

Add required indexes to your Splunk server

Starting in Splunk SOAR version 6.2.0, Splunk SOAR is using universal forwarders instead of remote search to bring your Splunk SOAR data into Splunk Enterprise or Splunk Cloud Platform and provide visibility of your Splunk SOAR data in your Splunk App for SOAR dashboards. For more information on universal forwarders, see the links later in this section.

To configure searching, add the required Splunk SOAR indexes to your Splunk server:

1. Go to the Configurations tab.
2. In the Advanced Options section, from the Create indexes (REQUIRED for SOAR Remote Search and SOAR System Logs) dropdown menu, select the Create Indexes option.
3. Perform the steps for your Splunk SOAR version:
• For Splunk SOAR versions 6.2.0 and later:
  Configure universal forwarders following the instructions for your Splunk SOAR deployment, see Configure search in Splunk SOAR (Cloud) or Configure search in Splunk SOAR (On-premises).
• For Splunk SOAR versions 6.1.1 and earlier:
  1. Set up remote search on a standalone or distributed instance of Splunk Cloud Platform or Enterprise.
  2. Reindex your data to bring in data from Splunk SOAR into Splunk Cloud Platform or Enterprise.
4. View any Splunk App for SOAR dashboard to make sure data is populating.

If you want past data to appear in Splunk App for SOAR dashboards, you must reindex your Splunk SOAR data. By default, only new data appears.

Configure the app

Reference the sections here to determine the configuration your instance needs in order for you to use Splunk App for SOAR.

Where to configure the app in a distributed deployment

Use the table to check the compatibility of the app with Splunk Enterprise distributed deployment features.

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	Use the search head cluster deployer to distribute apps across search head cluster members. See Use the deployer to distribute apps and configuration updates in the Splunk Enterprise Distributed Search manual.
Indexer Clusters	Yes	The app contains indexes or index-time transformations.
Deployment Server	No	The app does not contain inputs for forwarder data collection.

After you've verified compatibility, use the table to determine where to configure the app in a Splunk Enterprise distributed deployment.

Splunk instance type	Can the app be configured here?	Comments
Search Heads	Yes	Configure this app on the search head.
Indexers	Yes	The app contains indexes or index-time transformations.
Forwarders	No	The app does not contain inputs for forwarder data collection.

Configure or upgrade the app using Splunk Web

1. Log in to the Splunk Cloud Platform or Splunk Enterprise search head.
2. On the Applications menu, scroll to the bottom and select Find More Apps.
3. On the Browse more apps page, locate the app in the list, or type the name in the search box.
4. Provide your splunk.com credentials.
5. Accept the license terms.
6. Select Upgrade app if you want to overwrite the existing configuration (optional).
7. Select Login and Install.
8. Select Done.

Configure or upgrade the app from a downloaded file

1. Log in to splunkbase.splunk.com.
2. Download Splunk App for SOAR and save it to an accessible location.
3. Log in to the Splunk Cloud Platform or Splunk Enterprise search head.
4. On the Applications menu, select the Manage Apps () icon.
5. On the Apps page, select Install app from file.
6. On the Upload app page, select the Choose file button to locate the app.
7. Select Upgrade app to overwrite the existing configuration (optional).
8. Select Upload.
9. Select Done.