Followed the following documentation for setup: https://www.secopshub.com/t/managing-splunk-es-notable-events-in-swimlane/135 Receiving the following errors: 11/7/18 12:06:56.925 AM 11-07-2018 00:06:56.925 -0500 ERROR sendmodalert - action=swimlane_action STDERR - Unexpected error: HTTPSConnectionPool(host='*******', port=443): Max retries exceeded with url: /api/user/login (Caused by ConnectTimeoutError(, 'Connection to ******** timed out. (connect timeout=60)')) host = ******** source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 11/7/18 12:06:54.316 AM 11-07-2018 00:06:54.316 -0500 ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 3., search='sendalert swimlane_action results_file="/opt/splunk/var/run/splunk/dispatch/rt_scheduler_adminSplunkEnterpriseSecuritySuiteRMD584a10c448120c834_at_1541564516_68.271_5A305BFB-0AC6-45C1-B4A3-F3F373D89467/results.csv.gz" results_link="https://plspksearch007.bah.com:8000/app/SplunkEnterpriseSecuritySuite/@go?sid=rt_scheduleradminSplunkEnterpriseSecuritySuite_RMD584a10c448120c834_at_1541564516_68.271_5A305BFB-0AC6-45C1-B4A3-F3F373D89467" param.action_name=swimlane_action | stats count' host = ******* source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd 11/7/18 12:06:54.264 AM 11-07-2018 00:06:54.264 -0500 ERROR sendmodalert - action=swimlane_action STDERR - Unexpected error: HTTPSConnectionPool(host='******', port=443): Max retries exceeded with url: /api/user/login (Caused by ConnectTimeoutError(, 'Connection to ***** timed out. (connect timeout=60)')) host = ******** source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd Verified the credentials are all correct and firewalls are allowing the traffic.. Can telnet to the swimlane server via 443 from the Splunk ES SH. ... View more