Splunk Phantom

Phantom can't receive the events from splunk


I installed the Phantom App for Splunk & CIM app.

And connectivity testing between Splunk and Phantom is passed.

I created alerts on Splunk to send events to Phantom, but I didn't see any records in Phantom's events.

From the index CIM_MODACTIONS, I can see an error log: “Unable to create container: cannot execute INSERT in a read-only transaction”

So is that what's causing the problem? But I don't understand what permissions I'm missing.


Labels (1)
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST