Hello, I've created adaptive response action with Add-on builder 3.0.1. It creates a ticket in ticketing system.  Splunk enterprise security 6.2.0 is running in a cluster. Indexers are also clustered, multi-site. Splunk is 8.0.6. When action is triggered from saved alert, it works perfectly. When running ad hoc action from Incident review page the script gets executed twice and creates two same tickets. There is a 5 seconds difference between two actions. Why would it be executed twice? Goran   ... View more

Hello, I am building an TA with Splunk add-on builder with scripted input. I want to give a user the possibility to set static host field for each input. I cannot add host field in data input parameters because I am getting an error: "Internal name The input parameter name 'host' is a reserved keyword" How can I do that? Hostname or IP is not in the event data, but I have an input parameter hostname which I could use. ... View more

Is there a recommended number of CPU cores for client workstation accessing Splunk ES? The company is running virtual consoles with very conservative resource allocation. Splunk being JavaScript based, I figured this can result in lagging and overall decreased user experience. ... View more

What does this warning mean and how does it impact the performance? The percentage of small of buckets created (40) over the last hour is very high and exceeded the yellow thresholds (30) for index=win, and possibly more indexes, on this indexer What to do to remediate? Thank you ... View more

Ï have dashboard with time range picker. When I try to select Date Range or Data and Time Range, I cannot select the latest date. It is always "now". How can I configure this? ... View more