Prepare for upcoming Splunk 10: upgrade SOAR apps before your Splunk 10 upgrade

Applicability

SOAR Cloud (with and without Splunk instance)SOAR On-PremUsers running apps or playbooks dependent on Splunk Search API v1Affected apps: Splunk App for SOAR Export (SASE), Splunk App for SOAR (SAS), Splunk Connector, any apps using Search API v1

Description

This knowledge article outlines critical actions required to ensure Splunk SOAR Cloud and On-Prem users are fully prepared for the deprecation of the Splunk Search API v1, which is part of the Splunk 10 upgrade rollout.

Splunk are notifying Splunk SOAR users about the Search API change involved with the upcoming rollout of Splunk 10. This change will affect various apps, including the Splunk App for SOAR Export (SASE), the Splunk App for SOAR (SAS), Splunk connector, and custom SOAR apps that use Search API v1 endpoints. 

Prior to upgrading Splunk instance to Splunk 10, user must upgrade all affected apps and playbooks to ensure compatibility and avoid potential automation disruptions. For more information about the Splunk 10 upgrade, please refer to this article: Preparing to upgrade from 9.x to Splunk Enterprise and Cloud Platform 10.0 in Splunk Lantern.

Summary

*Review the information for components that are relevant to user deployment.

Component Type	Required Action	Impact if Not Addressed
Splunk App for SOAR Export (SASE)	Upgrade to SASE v4.3.26	Unable to send data between the Splunk Platform and Splunk SOAR
Splunk App for SOAR (SAS)	Upgrade to SAS v1.0.72	Unable to use the restsoar generating command to retrieve information and pull audit logs from Splunk SOAR instance
Splunk Connector below v2.12.0	Upgrade to v2.12.0 or higher	Broken automation
Playbooks and apps that use Search API v1 endpoints	Update input parameters in playbooks and custom apps that use v1 endpoints	Broken automation

 

Investigation

Analysis of SOAR environments revealed the following potential failure points related to the upcoming Splunk 10 upgrade:

• Use of deprecated Search API v1 endpoints in apps and playbooks, which are no longer supported in Splunk 10.
• Deployed app versions are below the required compatibility level, including legacy versions of the Splunk App for SOAR Export (SASE) and the Splunk App for SOAR (SAS), Splunk Connector.
• Automation and data integration may fail if apps and playbooks are not updated to align with Splunk 10 requirements.

These findings indicate the need for proactive updates to prevent service disruption and ensure continued functionality.

Resolution

 

A. Upgrade Splunk App for SOAR and Splunk App for SOAR Export:

1. Download the latest versions from Splunkbase:

• Splunk App for SOAR Export (SASE) v4.3.26
• Splunk App for SOAR (SAS) v1.0.72

 

2. Review the release notes and version compatibility in the Splunk App for SOAR and Splunk App for SOAR Export documentation. Then follow the steps to upgrade each app.

• Splunk App for SOAR Export (SASE) documentation
• Splunk App for SOAR (SAS) documentation 

 

3. Restart Splunk instance. 

 

4. Re-validate role-based permissions and test integration workflows.

• Splunk App for SOAR Export (SASE) roles
• Splunk App for SOAR (SAS) roles

 

B. Upgrade Splunk Connector below v2.12.0

If users have deployed Splunk app:

1. Check the app version.
2. Upgrade to version v2.12.0 or higher from Splunkbase.

C1. This is for cloud environment:  Update playbooks and apps that use Search API v1 endpoints

1. Take actions based on user Splunk SOAR cloud setup:

• If users are able to search SOAR data in Splunk:

◦ Run a query to identify playbooks (playbook ID, action) that use Search API v1 endpoints:

   index=phantom_playbook_run | search "*search/v1/jobs*" OR "*search/jobs*" | eval playbook_id=playbook | table playbook_id message 

◦ Run a query to identify apps (connector name, action, and endpoint) that use Search API v1 endpoints:

   index=splunk_app_soar source="/opt/phantom/var/log/phantom/spawn.log" | spath message | search message="*(/opt/phantom/lib/automation/phantom/base_connector.py:306)" | search "*search/v1/jobs*" OR "*search/jobs*" 

• If users are NOT able to search SOAR data in Splunk:
  ◦ Manually review user playbooks to detect any usage of Search API v1 endpoints.

C2. This is for on-premises environment: Update playbooks and apps that use Search API v1 endpoints

       1. Take actions based on user Splunk SOAR on-premises setup:

           • If users are able to search SOAR data in Splunk:

◦ Run a query to identify playbooks (playbook ID, action) that use Search API v1 endpoints:

   index=phantom_playbook_run | search "*search/v1/jobs*" OR "*search/jobs*" | eval playbook_id=playbook | table playbook_id message 

◦ Run a query to identify apps (connector name, action, and endpoint) that use Search API v1 endpoints:
   Please delete the blank space between log and /phantom in the second line before running the query.

   index=splunk_app_soar source="/opt/phantom/var/log/phantom/spawn.log" | spath message | search message="*.       

   (/opt/phantom/lib/automation/phantom/base_connector.py:306)" | search "*search/v1/jobs*" OR "*search/jobs*" 

• If users are NOT able to search SOAR data in Splunk:

              Search endpoint keywords such as /services/search/jobs/export in SOAR spawn logs to identify references to v1 endpoints

              using the command:   

              grep -E '/search/jobs|/search/v1/jobs' spawn.log*

1. Replace all input parameters referencing Search API v1 endpoints with the corresponding v2 endpoints.
2. Refer to the REST API Reference Manual for detailed information on the correct v2 endpoints and required input parameters.
3. Refactor user custom apps that use Search API v1 endpoints in the app code.
4. Validate that user existing playbooks still function as intended after user update user playbooks.

 

Revision History

Revision	Publish Date	Comments
1.0	01-Oct-2026	Initial Release