Splunk App for SOAR Export[SASE]: The SOAR Instance dropdown does not produce any results when configuring the "Send to SOAR" alert action.

Applicability

Description

The configuration page for the "Send to SOAR" alert action shows a message stating "Search produced no results" beneath the SOAR Instance dropdown.

However, the SOAR Server configuration page within the SASE app successfully has the SOAR server configured.

Investigation

After verifying the user's permissions and ensuring that the required phantom_read and phantom_write capabilities were assigned, executed the following REST command in the UI to check if it produced any results. Unfortunately, the command returned no results and raised errors indicating that the REST endpoints were not found in the IDX cluster members.

However, when searched with the parameter splunk_server=local, it produced results.

This clarified that the REST call is being searched on the Indexers (IDX) and not on the Search Head (SH) cluster members.

Resolution

After examining the distributed search group settings in distsearch.conf, it was observed that the default group did not include any search head cluster members, causing REST calls to be exclusively distributed to indexers. To resolve this issue, search head cluster members were added to the default distributed search group, restoring the functionality of the SOAR instance dropdown.