Use the System Insights dashboard

Using system insights in Splunk App for SOAR to visualize SOAR data

View automation health, and future system health, of your Splunk SOAR instance through dashboards you can customize and save. System Insights includes Splunk SOAR automation data, like playbook runs, ingestions, along with action and block results.

Get started

System Insights displays Splunk SOAR data within Splunk App for SOAR.

Splunk SOAR version

  • Requires Splunk SOAR version 8.5.0 or higher.

If you have already installed Splunk App for SOAR version 1.0.77 or higher

Update your universal forwarder configuration to send System Insights data.

  1. From the Home menu, select Administration > Administration Settings > Forwarder Settings.

  2. Edit the forwarder group you want to use. Select the System Insights data type, then select Save.

For details, refer to the appropriate documentation for your deployment:

If you have already installed Splunk App for SOAR before version 1.0.77

  1. Update to Splunk App for SOAR version 1.0.77 or higher. For details, see Install Splunk App for SOAR on Splunk Enterprise or Install Splunk App for SOAR on Splunk Cloud Platform.

  2. Update your universal forwarder configuration to send System Insights data.

    1. From the Home menu, select Administration > Administration Settings > Forwarder Settings.

    2. Edit the forwarder group you want to use. Select the System Insights data type, then select Save.

For details, refer to the appropriate documentation for your deployment:

If you have not already installed Splunk App for SOAR

Install Splunk App for SOAR. For instructions, refer to Install and Configure Splunk App for SOAR.

During the steps for configuring data forwarding, be sure to specify forwarding for System Insights data. For details, refer to Set up the universal forwarder using Splunk SOAR.

System Insights is turned on by default. If you choose to turn it off, refer to Turn off System Insights later in this article.

Turn off System Insights

If you choose not to use System Insights, you can turn it off.

To turn off System Insights, follow these steps:

  1. In Splunk SOAR Home menu, select Administration, then Product Settings, then System Insights.

  2. Set the switch to the Off position.