Create a saved search export to send data to Splunk Phantom

To send data to Splunk Phantom in the form of a saved search export, follow these steps for guidance.

Before you create a saved search export

To create a saved search export, you must first set up a saved search in your Splunk platform instance. For instructions on setting up a saved search, see the Saving searches topic in the Splunk Search Manual. Check that your saved search has read permissions enabled so that the Phantom Add-On for Splunk can discover your saved searches.

Make sure you have set up Splunk Phantom read and write access and configured the Splunk Phantom server. See Configure the Phantom Add-On for Splunk in the Install and Upgrade the Phantom Add-on for Splunk manual.

Create a saved search export

To create a saved search export in the Phantom Add-On for Splunk, follow these steps:

1. Navigate to the Event Forwarding tab in the Phantom Add-On for Splunk.
2. Click New Saved Search Export.
3. Enter a name for the configuration.
4. Select the saved search that contains the data you want to send to Splunk Phantom.
5. (Optional) Select a container name. You can also leave this field as the auto-generated name.
6. (Optional) Select an artifact label. This will attach a label to the artifact in Splunk Phantom.
7. Select a destination. Choose from the servers that you configured on the Phantom Server Configuration page.
8. (Optional) Enter a container label. This label must exist in the Splunk Phantom instance. If you don't see your container label, see Troubleshooting.
9. Create a schedule for the saved search export. For the most optimized search, choose the shortest amount of time possible. This is recommended as it helps the system perform better. By default it will be set to Every 5 Minutes.
10. Select the time frame you want to preview the search results for.
11. You can either choose to configure the search fields manually or auto-extract the fields. Auto-extracting the fields pre-populates the fields that you already configured in your saved search.
12. Configure the saved search fields. Configuring these fields selects how the data will be organized and labeled in Splunk Phantom. The search fields represent the CIM fields in your Splunk platform instance, while the CEF fields determine how the data appears in Splunk Phantom.
    1. Click the plus button if you want to add additional fields to Splunk Phantom. If you choose to add additional fields, ensure to check the Group By box next to the field you want to group your data by in Splunk Phantom.
13. For custom CEF fields, add a field under Contains if you have actions you want to take on that part of the data. If you configure this field, a drop-down list appears with a list of actions.
14. Click the Enabled check box to enable or disable your configuration.
15. Click Save and Preview. If the preview looks correct, click Send to Phantom.
16. Click Save and Close to save your search without previewing it.
17. If you have configured your saved search export correctly, a success message will appear with a link to your container.

Delete or clone your saved search export

After you save your saved search export, you can choose to delete or clone it by clicking the Delete or Clone buttons under the Actions column. Cloning your saved search export can save time later if you choose to create a similar saved search export.