Splunk® App for SOAR Export

Use the Splunk App for SOAR Export to Forward Events

Configure how Splunk SOAR handles multivalue fields in Splunk ES notable events

Some fields in Splunk Enterprise Security (ES) notable events can contain multiple values, such as multiple user names. You can configure how much multivalue fields are handled when creating corresponding artifacts in Splunk SOAR:

  • Create a single artifact containing multiple values in the field.
  • Create one artifact for each value in the field, so if three user names exist in the username field, then three artifacts are created.

By default, multivalue fields are split so that one artifact per value is created. Perform the following tasks to change this behavior:

  1. Navigate to the Splunk App for SOAR Export installed on your Splunk platform instance.
  2. Click the Configurations tab.
  3. In the Advanced Options field, click Configure Multivalue Field Handling for ES Adaptive Response to expand the panel.
  4. Select how you want to handle multivalue fields.
  5. Click Update Advanced Preferences.

The multivalue field setting applies globally to all notables sent from Splunk ES to Splunk SOAR.

If you are using two Splunk instances for adaptive response relay, the multivalue fields setting is determined by the setting on the heavy forwarder. See Use adaptive response relay to send notable events from Splunk ES to or Splunk SOAR.

Last modified on 07 May, 2024
Configure global field mappings   Back up and restore configuration files for Splunk App for SOAR Export

This documentation applies to the following versions of Splunk® App for SOAR Export: 4.3.13


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters