Troubleshoot event forwarding

If you encounter the following issues, follow these steps for guidance.

Container labels not showing up in Splunk Phantom

With data model and saved search exports, the container label must exist in the server or it does not appear in Splunk Phantom. It is easiest to leave the container label as the default. When you leave the label as the default, the app finds a generic label to use that exists in Splunk Phantom.

Saving a Splunk Data Model Export fails with an error

Saving a data model export in the Splunk Phantom App for Splunk fails with the following error if Splunk Enterprise or Splunk Cloud is configured to use the Free license group:

Argument "action.script" is not supported by this handler.

Saved searches are disabled on the Splunk Phantom App for Splunk in the Free license group. The minimum license level required for saved search functionality is the Trial license group. You can view you current license level in Splunk Web by selecting Settings > System > Licensing.