Splunk Phantom

Phantom can't receive the events from splunk

PwC-Kimmy
Explorer

I installed the Phantom App for Splunk & CIM app.

And connectivity testing between Splunk and Phantom is passed.

I created alerts on Splunk to send events to Phantom, but I didn't see any records in Phantom's events.

From the index CIM_MODACTIONS, I can see an error log: “Unable to create container: cannot execute INSERT in a read-only transaction”

So is that what's causing the problem? But I don't understand what permissions I'm missing.

 

Labels (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!