Phantom can't receive the events from splunk

Splunk SOAR

I installed the Phantom App for Splunk & CIM app.

And connectivity testing between Splunk and Phantom is passed.

I created alerts on Splunk to send events to Phantom, but I didn't see any records in Phantom's events.

From the index CIM_MODACTIONS, I can see an error log: “Unable to create container: cannot execute INSERT in a read-only transaction”

So is that what's causing the problem? But I don't understand what permissions I'm missing.

Get Updates on the Splunk Community!

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...