Search within Splunk SOAR (On-premises)

Splunk SOAR (On-premises) includes an embedded copy of Splunk Enterprise for searching data in Splunk SOAR (On-premises).

You can also configure search using an external Splunk Enterprise instance, or distributed Splunk Enterprise deployment. For more information, see Configure search in Splunk SOAR (On-premises) in the Administer Splunk SOAR (On-premises) manual.

Searching in Splunk SOAR (On-premises)

There is a search box in the upper left of every Splunk SOAR (On-premises) screen. Most screens also have a section specific search box below the menu bar. Section specific search boxes display text indicating what it will search. For example, on the Indicators screen, the section specific search box contains "Search indicator values".

For non section specific searches, when you enter a search term, it appears as part of the URL in the address bar, so you can create a bookmark.

For example:

https://<Splunk SOAR URL>/search?query=events

Search results can vary as changes in Splunk SOAR (On-premises) occur between visits to the search page.

Initial search results are returned without filters applied. The search results page has a row of checkboxes for the following predefined filters; Containers, Artifacts, Actions, Assets, Apps, or Other to narrow your search results. Click the checkbox next the the filter you want to apply.

Search results are displayed in groups of 10 results per page. Use the menu in the bottom center of the search results page to view a up to a maximum of 100 results per page.

The search directives in Splunk SOAR (On-premises) are limited to a subset of the Splunk Processing Language (SPL). If you're using an external Splunk Enterprise instance as your Splunk SOAR (On-premises) search engine, you can use all of the Splunk Enterprise features through the interface on that instance. For more information, see Understanding SPL syntax in the Splunk Enterprise Search Reference manual.

Available search operators in Splunk SOAR (On-premises) are:

• Boolean operators; AND, OR, and NOT. The NOT operator excludes an entire object from appearing in the search results, even if other terms within that object match.
• Parentheses to group terms into more complex boolean searches.
• Quotation marks to search for exact phrases.
• The wildcard character '*'.

Searching with multiple words creates an implied ALL condition. For example, the term data path returns results containing both data and path. Use OR to find results containing either data or path.

Search examples

Search for the exact phase "data path":

"data path"

Search for objects that contain both "data" and "path":

data AND path

Search for any objects that contain a match for "dat":

dat*