- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting failed to communicate with platform component: phantom_decided when try to save a playbook
tekybala
New Member
07-26-2021
12:17 AM
Hello,
I'm currently exploring Splunk Phantom or Splunk SOAR. When I try to create a new playbook or copy and save any existing playbook I'm getting the following error. Please advise.
failed to communicate with platform component: phantom_decided
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

phantom_mhike

SplunkTrust
08-06-2021
10:42 AM
I have seen this happen a couple of ways. The most frequent but unobvious one is that your login session has expired but the playbook editor was still open. If that is not the case, then I would check on phantoms running processes and make sure decided is running along with the rest of the phantom services. Worst case scenario, try restarting the phantom platform by running /opt/phantom/stop_phantom.sh followed by /opt/phantom/bin/start_phantom.sh
