topic Re: splunk soar run query action in splunk APP in Splunk SOAR

splunk soar run query action in splunk APP

saraomd93 — Sat, 30 Aug 2025 16:34:57 GMT

♌💓💓

Hello friends,
In order to run a query starting with a pipeline (|) in the run query action of the Splunk App on SOAR version 6.4, you need to prepend an index and hostname that do not actually exist.

Example:

index=not hostname=not append [ | inputlookup ... | eval command=... ]

This way, the query will execute correctly even though the main logic begins with a pipeline.

Re: splunk soar run query action in splunk APP

MattHyperion3 — Mon, 10 Nov 2025 04:48:16 GMT

A better way to approach this is to use inputlookup as your command rather than search

For example to run | inputlookup my_list.csv | search blah...
Configure your action block like this

command: inputlookup
query: my_list.csv | search blah...

this runs the query as expected in Splunk as | inputlookup my_list.csv

Many commands are valid to use which are not listed in the app just as make results and collect etc which are super handy to run in SOAR playbooks!