Hi all, I’ve been using the Splunk API to fetch alert data via /search/jobs/{sid}/results. For authentication, I’m using a Splunk token. When I run my script to retrieve the data, I encounter the following error. However, if I rerun the code a few times, I’m eventually able to fetch the data successfully. I’m confident this is not related to any firewall restrictions. Could someone please help me understand how to resolve this issue? ERROR:app.services.splunk_connector:HTTPSConnectionPool(host='<stack>.splunkcloud.com', port=8089): Max retries exceeded with url: /services/search/jobs/{sid}/results?output_mode=csv&count=0&output_results_fields=%2A (Caused by ConnectTimeoutError(<HTTPSConnection(host='<stack>.splunkcloud.com', port=8089) at 0x20189cf1310>, 'Connection to <stack>.splunkcloud.com timed out. (connect timeout=None)'))   ... View more

I have the below Query: | inputlookup host.csv | rename hostname AS host | eval host=lower(host) | eval in_lookup=1 | append [ search index=wineventlog EventCode=33205 | eval host=lower(host) | stats latest(_time) AS last_ever by host ] | stats max(in_lookup) AS in_lookup max(last_ever) AS last_ever by host | where in_lookup=1 | eval status=if(isnull(last_ever) OR last_ever < relative_time(now(), "-1h"), "No data in last 1h", "OK") | where status="No data in last 1h" | stats dc(host) AS affected_hosts values(host) AS hosts I have created alert with alert action webhook which will triggers my webhook and a ticket is send to our custom ticketing tool. This alert is running but I see no events are generated which is not triggering my webhook and tickets were not getting created. When I click on view results, it displays 0 events, but if i run the query manually, there are events during the same time range. I am trying to figure it out whole day. Any help will be highly appreciated!!! ... View more