Splunk Enterprise Security

Phantom: When running a Splunk action why the error "Failed to acquire lock"?

apollo_sj
New Member

Hi All,

We are running an Splunk action - run query (search) on a Phantom playbook which is active on every event coming on to phantom. However, at times the action - run query (search) fails with message: Failed to acquire lock named '08' for Action: 'run query', App: 'Splunk'. Failed to acquire the lock '08'. The action - run query (search) tries to execute for 30 minutes or so and eventually fails. Any help to troubleshoot this issue is highly appreciated.

 

Thanks in advance 🙂

 

Labels (2)
0 Karma

JH_1234
New Member

I had this issue today, and I had to go back through my phantom events, and there was a run query that had been running for 24 hours. I'm not sure why it didn't time out, but find when your error started happening and look at the phantom event right before it and see if there is an action that is stuck in a running state and terminate it.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...