Ad hoc adaptive response executed twice

[goran_epl]

Hello,

I've created adaptive response action with Add-on builder 3.0.1. It creates a ticket in ticketing system. 

Splunk enterprise security 6.2.0 is running in a cluster. Indexers are also clustered, multi-site. Splunk is 8.0.6.

When action is triggered from saved alert, it works perfectly. When running ad hoc action from Incident review page the script gets executed twice and creates two same tickets. There is a 5 seconds difference between two actions.

Why would it be executed twice?

Goran

[morawi5]

@gor @ebond_splunk  - Are you also seeing duplicates when using something like "ping" too?

[ebond_splunk]

Hey @morawi5 , yep,  we figured out that all dispatched adhoc mod actions are duplicating. But we also discovered the problem and implemented a fix for the next maintenance release.  If you have access to your splunk instance files, I can show you what file to update. It's a one liner fix in python. Let me know!

[goran_epl]

Yes please. We would like to give a shot with one liner fix in python.

Can you please send it?

[morawi5]

So you'll need to open file "etc/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py". And add to line 561.

'preview': 'false',

  Basically you'll want the code block to look like this:

args = {
    'output_mode': 'json',
    # CIM-944: adhoc_search_level essential to proper field extraction
    'adhoc_search_level': 'verbose',
    'preview': 'false',
    'search': search
}

 Restart afterwards - This worked from me, kudos to @ebond_splunk 

[morawi5]

Yep, I do have access, just private messaged you.

[morawi5]

We are also seeing the same exact situation on Splunk 8.1.1 and ES 6.4.1 

[ebond_splunk]

@goran_epl 

Were you able to find a solution? If so, there's a similar situation occurring with another customer and we're trying to figure out a solution. The issue is that we can't replicate what's going on. Any ideas?