Duplicate Events Forwarded to Phantom

[erika_horton]

We are using the Phantom Add-on to forward events from our ES SH to our Phantom instance, but after upgrading to v. 4.035 we have started getting duplicates of all events in Phantom.

The configuration was created in the Phantom Add-on UI, and is set to run every 10 minutes.

[kprior201_lilly]

As a heads up: they are tracking this as a bug. I had a support ticket open for the same issue after an upgrade.

[dennyw]

Could you please share more insights about the bug like id or official statement? Did it get resolved in newer release? was asking because i didn't find any relevant info in 'fixed issues' section of the release notes.. 

[erika_horton · Accepted solution]

When setting the search schedule from the Phantom Add-on UI, it appears that Splunk defaults to doubling the search time range.
You can see this if you navigate to Searches, Reports and Alerts and look at the saved searches under the Phantom add-on.
The search will be named "_phantom_app_<configuration name>", so in this case, "_phantom_app_Crowdstrike Detection"
If you select "Edit Schedule", you can see the schedule is set to run on cron schedule with the configuration of */10 * * * *, and the Time Range is set to "Custom Time".
You can open the custom time and shrink the window here to reduce duplicated events being forwarded to Phantom.