Splunk® SOAR (On-premises)

Administer Splunk SOAR (On-premises)

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

Assess app and asset connectivity and ingestion

Check that your apps and assets are properly connected, are able to communicate with your , and are ingesting data properly.

Monitor all apps and assets

Monitor all of your apps and assets with any of the methods described in this section.

View Asset Health

View the Asset Health panel on the Home page of to see the status of all of your apps and assets. Sort by Status to see group any assets with a Failed status. Select any asset to see its app page.

For information on troubleshooting connectivity for an app or asset, see Troubleshoot connectivity for a specific app or asset later in this topic.


Check status through REST API

Use the app_status REST API call to check the status of your apps and assets.

For information on how to use the REST API call, see /rest/app_status in the REST API Reference for documentation.

For information on troubleshooting connectivity for an app or asset, see Troubleshoot connectivity for a specific app or asset later in this topic.

Troubleshoot connectivity for a specific app or asset

Some common causes of of failed connectivity include:

  • The connection is missing or improperly configured
  • You don't have proper credentials to access the asset
  • cannot connect to the specified service
  • If you're connecting to assets using the Splunk SOAR Automation Broker, make sure the Automation Broker is correctly configured. See Configure Connectors to use the Splunk SOAR Automation Broker in Set Up and Manage the Splunk SOAR Automation Broker.

When you encounter a specific app or asset with a failed connectivity status, address the issue using steps described in this section.

Within the asset settings

To test connectivity of an app or asset with a Failed status, follow these steps:

  1. Open the app page using one of these methods:
    • In the Asset Health panel, select an asset.
    • From the Home menu, select Apps. For the desired app, locate and select the configured asset.
  2. Select the Asset Settings tab.
  3. Select Test Connectivity.
  4. A test results message appears. Read the message and save a copy of it for your reference. Then click Close.
  5. Edit the app configuration to address the connectivity message. Check the common causes of connectivity issues described earlier in this section.

If you cannot troubleshoot the connectivity issue on your own, contact Splunk Support. For details on Splunk Support, see Administer .

Check Ingestion Status

Your apps must be connected and also able to ingest data in order to be fully functional.

To check if your apps are able to ingest data, follow these steps:

  1. In your instance, from the Home menu, select Administration.
  2. Select Ingestion Summary and view the chart. Check that the values on the chart are not all zeros.
  3. Select Ingestion Status. The first section of the page shows successful ingestion for your apps. Review the Ingestion Errors section to see if there are any errors.

If there are ingestion errors:

For additional information on data ingestion, see View how much data is ingested in using ingestion summary and View ingested container statistics using Ingestion Status.

Last modified on 02 April, 2024
Add and configure apps and assets to provide actions in  

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.2.1, 6.2.2, 6.3.0, 6.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters