https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Correlation-Search-use-Adaptive-Response-Actions-5mins/m-p/474740#M7380 <P>Rather than trying to increase Adaptive Response (AR) timeout, I would try to simplify your correlation search and the other searches required to feed inputs to AR, so they complete quickly. E.g you may pre-process known data/searches, to be used in correlation and/or AR invocations.</P> Wed, 06 May 2020 09:35:19 GMT lakshman239 2020-05-06T09:35:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Correlation-Search-use-Adaptive-Response-Actions-5mins/m-p/474739#M7379 <P>when I create a Correlation Search ,this Correlation Search will trige Adaptive Response Actions. But search result is very large,so action will run for a long time. But when action run after 5min,this action stop. I don't know why action stop but search result didn't process completely. How to make the 5min disappear.</P> Sun, 07 Jun 2020 16:32:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Correlation-Search-use-Adaptive-Response-Actions-5mins/m-p/474739#M7379 wlight600 2020-06-07T16:32:07Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Correlation-Search-use-Adaptive-Response-Actions-5mins/m-p/474740#M7380 <P>Rather than trying to increase Adaptive Response (AR) timeout, I would try to simplify your correlation search and the other searches required to feed inputs to AR, so they complete quickly. E.g you may pre-process known data/searches, to be used in correlation and/or AR invocations.</P> Wed, 06 May 2020 09:35:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Correlation-Search-use-Adaptive-Response-Actions-5mins/m-p/474740#M7380 lakshman239 2020-05-06T09:35:19Z