Jobs are stuck in ECC Queue in ready state

[Bhawana Bhatt2]

Hi All,

As part of Splunk ES to SIR integration, some of the alerts are not getting converted into a security incident. When found in the ECC queue, we are seeing most of the jobs are stuck in ready state.

Could someone help with if any schedule is getting stuck or time out. Any mid server properties which needs modification?

Any help is much appreciated!

Thanks,

Bhawana

[Ankur Bawiskar]

@Bhawana Bhatt 

Refer below link

Why are my MID Server-related Jobs stuck and ECC Queue inputs still in Ready State?

Regards
Ankur

[Paolo6]

Hi Bhawana,

we had a similar problem and finally we found that the Business Rule "Set synchronous import set" was inactive.

See this case.

Paolo