Splunk Incident Review Adaptive Response not Working

[burakatabay]

Hi splunkers,
When ı research an incident and press the ESCU-Contextualize
and ESCU-Contextualize return a empty page status=failure
Why I see failure error ?

[andsov]

Did you ever solve this problem?

[alonsocaio]

It looks like the search didn't find the expected data in that context. Have you checked the recommended steps? Does your Splunk data matches them?

[burakatabay]

Yes matches them.

[alonsocaio]

Also, check user permissions to the resources listed in recommended steps. And if you are able, try running this adhoc search with admin user.

[burakatabay]

I try admin user
Result is same