Question list
Question 81 - SPLK-2003 discussion
The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?
A.
The existing content indexes on the SOAR server need to be re-indexed to migrate them to Splunk.
B.
The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.
C.
The remote Splunk search head is currently offline.
D.
Content that existed before configuring external search must be backed up on SOAR and restored on the Splunk search head.
Previous
Next
Your answer:
0 comments
Sorted by
Leave a comment first
