In Risk Analysis, the status shows failure in the Adaptive Responses on the Incident Review (IR) page.

Available Languages

Updated:September 29, 2026

Document ID:SPLK047055

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security

Description

The Risk Analysis in Splunk Enterprise Security uses Adaptive Response Actions to automate response based on notable events and the Risk Analysis process may fail, causing the status to be reported as failure on the Incident Review (IR) page.

Investigation

Investigated the Risk Analysis Adaptive Response Action configuration of the "email" field to see if there are extra spaces or formatting issues.

Resolution

To resolve this issue of the Risk Analysis status always showing failure.
Ensure that all filed names are correct.

Edit the Risk Analysis Adaptive Response action:

Navigate to Splunk Enterprise Security > Configure > Content > Content Management > Find the correlation search > Adaptive Response

Find the Specific Adaptive Response Action used for Risk Analysis.
Locate the "email" field in the Adaptive Response Action Configuration.
Ensure that there are no extra spaces before or after the email addresses.
Ensure the email addresses are correctly formatted and separated by commas if multiple addresses are specified.