SPLK-2003 · Question #115
The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search be
The correct answer is B. The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.. If, after configuring an external Splunk search head for search in SOAR, the search results do not include content that was previously returned, one possible issue could be that the user account configured on the SOAR side does not have the required permissions (such as the 'phan
Question
The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?
Options
- AThe existing content indexes on the SOAR server need to be re-indexed to migrate them to
- BThe user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.
- CThe remote Splunk search head is currently offline.
- DContent that existed before configuring external search must be backed up on SOAR and restored
How the community answered
(28 responses)- A7% (2)
- B54% (15)
- C25% (7)
- D14% (4)
Explanation
If, after configuring an external Splunk search head for search in SOAR, the search results do not include content that was previously returned, one possible issue could be that the user account configured on the SOAR side does not have the required permissions (such as the 'phantomsearch' capability) enabled on the Splunk side. This capability is necessary for the SOAR server to execute searches and retrieve results from the Splunk search head.
Topics
Community Discussion
No community discussion yet for this question.