Splunk® Phantom App for Splunk

Use the Splunk Phantom App for Splunk to Forward Events

This documentation does not apply to the most recent version of Splunk® Phantom App for Splunk. For documentation on the most recent version, go to the latest release.

Configure how Splunk Phantom and Splunk SOAR handle multivalue fields in Splunk ES notable events

Some fields in Splunk Enterprise Security (ES) notable events can contain multiple values, such as multiple user names. You can configure how much multivalue fields are handled when creating corresponding artifacts in Splunk Phantom or Splunk SOAR:

  • Create a single artifact containing multiple values in the field.
  • Create one artifact for each value in the field, so if three user names exist in the username field, then three artifacts are created.

By default, multivalue fields are split so that one artifact per value is created. Perform the following tasks to change this behavior:

  1. Navigate to the Phantom App for Splunk installed on your Splunk platform instance.
  2. Click the Configurations tab.
  3. In the Advanced Options field, click Configure Multivalue Field Handling for ES Adaptive Response to expand the panel.
  4. Select how you want to handle multivalue fields.
  5. Click Update Advanced Preferences.

The multivalue field setting applies globally to all notables sent from Splunk ES to Splunk Phantom or Splunk SOAR.

If you are using two Splunk instances for adaptive response relay, the multivalue fields setting is determined by the setting on the heavy forwarder. See Use adaptive response relay to send notable events from Splunk ES to Splunk Phantom or Splunk SOAR.

Last modified on 27 May, 2021
Configure global field mappings   Backup and restore configuration files for Splunk Phantom App for Splunk

This documentation applies to the following versions of Splunk® Phantom App for Splunk: 4.1.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters