How to add values or data from Secops SOAR to splunk lookup

Hi ​@RahulDevaraju thanks for your post. can you provide more details around your workflow and use case please? 

Not a direct way without using the IDE or some automation outside of SOAR. You would need to use the IDE to build a custom action to update the lookup.

If there is further automation you can configure on the Splunk side, you could look at using the Submit Event action within the SOAR integration with Splunk to send an event to Splunk that you could then take and potentially add to the lookup

Splunk is not necessarily event-driven like Secops.
Use the SplunkQuery action from the Secops SOAR integration for Splunk, to push the value into Splunk lookup table via SPL.

Here’s some examples but fine-tune as needed

basic:

|makeresults format=csv data="col1, col2
key1,val1
key2,val2
key3,val3" | fields col1, col2
| outputlookup example.csv

same idea but less basic:

| makeresults ```comment: generate event on search-time without relying on indexed data```
| eval samples="[Entity.Identifier]"
```assuming [Entity.Identifier] returns a list of comma-separated string (e.g., keyValue1,keyValue2,keyValue3) when serialized```
| eval column1=split(samples,",") ```transforms the delimited string into multivalue```
| mvexpand column1 ```expands the values of the multivalue field into separate events```
| eval column2=if(column1="[Playbook.Variable1]","[Playbook.Variable2]","etc","etc") ```extra columns as needed```
| stats values(column2) as column2 by column1
| outputlookup append=true example.csv
| stats count ```guardrail to stay within the connector result limit```