topic Re: Getting playbook output data from phantom.playbook API call in Splunk SOAR

Getting playbook output data from phantom.playbook API call

nongingerale — Thu, 02 Apr 2026 18:12:40 GMT

I currently have a playbook that runs 3 actions within it (creating a splunk search, sharing the job, and expanding ttl, all while using the loop-if-failure feature) and returns outputs (summary, status, and the search results). I'm trying to do a for-loop where it calls that playbook with different params using phantom.playbook() though I am having trouble finding the actual playbook output in the callback function.

Example:

for loop:
inputs = {<changing params>}
new_name = "<changing string>"
phantom.playbook("my_playbook", container=container, name=new_name, input=inputs, callback=my_callback)

where in my_callback:

I try phantom.collect2(container=container, datapath=["new_name:playbook_output:search_results_data"], action_results=results)

which doesnt work. I tried printing out general "results" which gives me info such as:
name
playbook
playbook_run_id
result (which contains a dictionary for info on each of the 3 actions)

but this doesnt include the output data of the playbook itself (or the run_query splunk search results).

I did see a past post that didnt get an answer (or at least not the answer that fits my scenario: https://community.splunk.com/t5/Splunk-SOAR/How-to-get-output-data-when-calling-a-playbook-through-the-API/m-p/698278). My use case needs to use the subplaybook and not the actions directly due to configuration reasons (mainly the asset field needs to be configurable rather than hard-set via the Splunk App runquery action block).

any help or direction would be super appreciated!

Re: Getting playbook output data from phantom.playbook API call

VatsalJagani — Fri, 08 May 2026 06:30:20 GMT

Hello @nongingerale

I don't have much experience but what I can see is:

phantom.collect2 with a playbook_output datapath works for static visual playbook blocks, not dynamic
calls from custom code in a loop. With a dynamic name, the datapath can't be resolved the way SOAR's data engine expects.

Maybe you can try to handle it in python code, something like this:

(code not tested)

def my_callback(action=None, success=None, container=None, results=None, handle=None, **kwargs): phantom.debug("my_callback() called") for result in results: run_id = result.get('playbook_run_id') if not run_id: continue # Hit SOAR's internal REST API — no auth token needed when called from within a playbook response = phantom.requests.get( f'/rest/playbook_run/{run_id}', verify=False ) if response.status_code != 200: phantom.error(f"Failed to get playbook run {run_id}: {response.status_code}") continue run_data = response.json() raw_outputs = run_data.get('outputs') # list of JSON-encoded strings if not raw_outputs: phantom.debug(f"No outputs for run {run_id} — is the subplaybook an input playbook with defined outputs?") continue for raw in raw_outputs: output = json.loads(raw) search_results = output.get('search_results_data') # your output name phantom.debug(f"Got search_results_data: {search_results}")

References:

I hope this helps!!!