Hi,
I'm trying Splunk SOAR Community Edition, and I'm having an issue with the Elasticsearch app.
I'm attempting to configure the asset with my Elasticsearch instance. The test connectivity is good, but I can't poll incidents with "poll now." I encounter this type of error:
Starting ingestion...
If an ingestion is already in progress, this request will be queued and completed after that request completes.
App 'Elasticsearch' started successfully (id: 1699519715123) on asset: 'elastic'(id: 4)
Loaded action execution configuration
Quering data for soar index
Successfully added containers: 0, Successfully added artifacts: 0
1 action failed Unable to load query json. Error: Error Message: Expecting value: line 1 column 1 (char 0)
However, when I use an action in a playbook with the command "run query," I can see data.
Has anyone ever encountered this error ?
