In Phantom, when adding an External Splunk under Administration Settings -> Search Settings, getting an error that test connection failed and when saving getting error "Save changes failed. Settings not updated. [u'Missing local Splunk configuration, please do not overwrite']. "
Caveat is my in Splunk test connectivity passes and I'm getting artifacts from Splunk.
↧