When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user

discovers that they need to be able to run two different on_poll searches.

How is this possible
A . Enter the two queries in the asset as comma separated values.
B . Configure the second query in the Phantom app for Splunk.
C . Install a second Splunk app and configure the query in the second app.
D . Configure a second Splunk asset with the second query.

View Answer

Answer: D

Explanation:

In scenarios where there’s a need to run different on_poll searches for a Splunk Cloud instance from Splunk SOAR, configuring a second Splunk asset for the additional query is a practical solution. Splunk SOAR’s architecture allows for multiple assets of the same type to be configured with distinct settings. By setting up a second Splunk asset specifically for the second on_poll search query, users can maintain separate configurations and ensure that each query is executed in its intended context without interference. This approach provides flexibility in managing different data collection or monitoring needs within the same SOAR environment.