Configure how Splunk Phantom and Splunk SOAR handle multivalue fields in Splunk ES notable events

Some fields in Splunk Enterprise Security (ES) notable events can contain multiple values, such as multiple user names. You can configure how much multivalue fields are handled when creating corresponding artifacts in Splunk Phantom or Splunk SOAR:

• Create a single artifact containing multiple values in the field.
• Create one artifact for each value in the field, so if three user names exist in the username field, then three artifacts are created.

By default, multivalue fields are split so that one artifact per value is created. Perform the following tasks to change this behavior:

1. Navigate to the Phantom App for Splunk installed on your Splunk platform instance.
2. Click the Configurations tab.
3. In the Advanced Options field, click Configure Multivalue Field Handling for ES Adaptive Response to expand the panel.
4. Select how you want to handle multivalue fields.
5. Click Update Advanced Preferences.

The multivalue field setting applies globally to all notables sent from Splunk ES to Splunk Phantom or Splunk SOAR.

If you are using two Splunk instances for adaptive response relay, the multivalue fields setting is determined by the setting on the heavy forwarder. See Use adaptive response relay to send notable events from Splunk ES to Splunk Phantom or Splunk SOAR.