Error occurred while expanding the adaptive response action in Incident review page
Available Languages
Applicability
Splunk Enterprise Security V7.1.0Description
In the Incident Review page, the following error occurred in the Notables while expanding the Adaptive Response Action.
Error: "Invalid or missing search ID".
Resolution
To resolve this issue, the below-mentioned macro needs to be modified. This macro is responsible for populating the adaptive response action in the dashboard.
Macro Name: "modular_action_invocations(2)".
Follow the below steps to implement the workaround,
- Navigate to Settings > Advanced search > Search macros
- Locate the "modular_action_invocations(2)" macro.
SPL in the macro:
tstats summariesonly=false latest(Modular_Actions.action_status) as action_status from datamodel=Splunk_Audit.Modular_Actions where Modular_Actions.action_name!="unknown" .....
Insert the "earliest" clause before "where" in the macro, as shown below:
tstats summariesonly=false latest(Modular_Actions.action_status) as action_status from datamodel=Splunk_Audit.Modular_Actions where earliest = -30d Modular_Actions.action_name!="unknown"....
Note: This issue has been addressed in version 7.2.0.
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Sep-2026
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)
Related Articles
- In Risk Analysis, the status shows failure in the Adaptive Responses on the Incident Review (IR) page.
- The "Run Adaptive Response Actions" is not listing all the alert actions in Splunk.
- Adaptive Response action returns "[HTTP 403] Client is not authorized to perform requested action"
- Duplicate risk notables are triggered unexpectedly under Incident Review page