Create a saved search export to send data to Splunk Phantom

To send data to Splunk Phantom in the form of a saved search export, follow these steps for guidance.

Before you create a saved search export

To create a saved search export, you must first set up a saved search in your Splunk platform instance. For instructions on setting up a saved search, see the Saving searches topic in the Splunk Search Manual. Check that your saved search has read permissions enabled so that the Phantom App for Splunk can discover your saved searches.

Make sure you have set up Splunk Phantom read and write access and configured the Splunk Phantom server. See Configure the Phantom App for Splunk in the Install and Upgrade the Phantom App for Splunk manual.

Create a saved search export

To create a saved search export in the Splunk Phantom App for Splunk, follow these steps:

1. Navigate to the Event Forwarding tab in the Splunk Phantom App for Splunk.
2. Click Add New.
3. Select Saved Search Export.
4. In the Name field, enter a name for this event forwarding configuration.
5. From the drop-down list in the Saved Search field, select the saved search containing the data you want to send to Splunk Phantom. When a saved search is selected, the search runs in the background. You can view the results of the saved search after completing the first page of the event forwarding configuration and clicking Next.
6. (Optional) From the drop-down list in the Container Name field, select a field whose value is used to generate the container name in Splunk Phantom.
   • Select Auto-generate and do not select any Group fields on the next screen to create a container using the name of this forwarding event configuration. For example, if you entered fwconfig in the Name field, the container is created with the name fwconfig.
   • Select Auto-generate and one or more Group fields on the next screen to create a container using the name of this forwarding event configuration and the CEF field name and value for each selected Group field. For example, if you entered fwconfig in the Name field and on the next page select Group using sourceAddress, the container is created with a name such as fwconfig sourceAddress:10.11.12.13.
   • Select a specific CIM field in the Container Name field to create a container using the value of the selected field. For example, if you select the src_ip field which returns the value 10.11.12.13, the container is created with the name 10.11.12.13.
7. (Optional) In the Artifact Label field, select an artifact label to attach to the artifact in Splunk Phantom.
8. In the Select Destination field, choose the Splunk Phantom server where you want to export your saved search. Choose from the servers that you configured on the Phantom Server Configuration page. See Connect the Splunk Phantom App for Splunk and the Splunk Platform to a Splunk Phantom server.
9. (Optional) In the Container Label field, enter a label for the container. This label must exist in the Splunk Phantom instance. If you don't see your container label, see Troubleshoot event forwarding.
10. Create a schedule for the saved search export. For the most optimized search, choose the shortest amount of time possible. This is recommended as it helps the system perform better. By default it will be set to Every 5 Minutes.
11. Click Next.
12. (Optional) Click on the name of the saved search to open the search in a new tab. You can use this to validate your search results at any time.
13. Select the desired severity and sensitivity of the alert sent to Splunk Phantom.
14. Configure unmapped fields. Select the field you want to map in the Search Fields column and map it to a CEF field in the CEF Fields column. Unmapped fields are ignored and not sent to Splunk Phantom. Click the Group checkbox if you want artifacts with the same value to be grouped together in the same container. For example, if you want group all artifacts with the same value in the _time field, select the Group checkbox next to the _time field and make sure it has a corresponding CEF mapping. Use the drop-down list in the Contains column for additional filtering. For example, select ip in the Contains column for a source field so that only source fields containing an IP address are sent to Splunk Phantom.
15. (Optional) Click Save Mappings to save your custom mappings as global field mappings. See Configure global field mappings.
16. Click on Mapped Fields to expand the section and verify the mappings. The Splunk Phantom App for Splunk automatically maps fields that it recognizes, or that are part of the global fields mappings. You can edit and of the field mappings as needed.
17. Click Save and Preview. If the preview looks correct, click Send to Phantom. This will send the individual event from the Splunk platform to Splunk Phantom.
18. Click Save and Close to save and send your search results.

If you have configured your saved search export correctly, a success message appears with a link to your container.

Delete or clone your saved search export

After you save your saved search export, you can choose to delete or clone it by clicking the Delete or Clone buttons under the Actions column. Cloning your saved search export can save time later if you choose to create a similar saved search export.