When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible?

Question

Options

• AInstall a second Splunk app and configure the query in the second app.
• BConfigure the second query in the Splunk App for SOAR Export.
• CEnter the two queries in the asset as comma separated values.
• DConfigure a second Splunk asset with the second query.

• A
  8% (3)
• B
  3% (1)
• C
  10% (4)
• D
  80% (32)

Explanation

In Splunk SOAR, when needing to run multiple on_poll searches to a Splunk Cloud instance, the recommended approach is to configure a second Splunk asset specifically for the second query. This method allows each Splunk asset to maintain its own settings and query configurations, ensuring that each search can be managed and optimized independently. This separation also helps in troubleshooting and maintaining clarity in the configuration. When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance and there is a need to run two different on_poll searches, the appropriate action is to configure a second Splunk asset with the second query. This allows each Splunk asset to have its own unique on_poll search configuration, enabling them to run independently and retrieve different sets of data as required. The other options, such as installing a second app or entering queries as comma- separated values, are not standard practices for managing multiple on_poll searches in Splunk

No community discussion yet for this question.