topic Re: Phantom Play Book Editor, Debugger Problem. Please Help in Splunk SOAR

Phantom Play Book Editor, Debugger Problem. Please Help

johnteo — Sun, 07 Jun 2020 17:25:39 GMT

For all of the playbooks I have executed and tried to test in the past 24 hours, none of them have successfully executed although no changes have been made to them and they worked fined previously.

The only output at Phantom would be Status: Running. However, upon further inspection the count of failures for running that playbook is increased by 1 for every time I test it.

All the assets are healthy and I have not exceeded he maximum number of actions. I would very much appreciate any assistance and insights offered!

Re: Phantom Play Book Editor, Debugger Problem. Please Help

phantom_mhike — Thu, 14 Nov 2019 17:31:58 GMT

The playbook editor and debugger have a lot of browser side processing going on and caching can cause issues especially after upgrades. That would be my first check. Clear browsing data or try an incognito tab and see if you have the same issue in the debugger.

If the issue persists, go to the container you were debugging against and click on the elipsis next to the playbook in the activity pane and look at the debug log there. If you still dont see the debug logs in this view, then there is something substantially wrong with your phantom instance. If you do see logs here, then this is almost certainly a browser caching issue. Clear all the browser datas and try again or test with a different browser.

Re: Phantom Play Book Editor, Debugger Problem. Please Help

johnteo — Fri, 15 Nov 2019 02:31:31 GMT

I have cleared all browser datas and tried testing again with different browsers as suggested.

I am also able to view the activity logs, however the same problem still persists whereby the testing is stuck at Status: Running. Could there be any other problems that could have caused this and methods to resolve it?

Re: Phantom Play Book Editor, Debugger Problem. Please Help

johnteo — Fri, 15 Nov 2019 02:46:04 GMT

This applies to all the playbooks that I try and execute

Re: Phantom Play Book Editor, Debugger Problem. Please Help

phantom_mhike — Fri, 15 Nov 2019 03:56:44 GMT

If it isnt a browser issue then my next shot would be to tail the logs at /var/log/phantom and look for any exception thrown while you try running the playbook.

This is not normal behavior at all. What phantom version are you on?

Re: Phantom Play Book Editor, Debugger Problem. Please Help

johnteo — Fri, 15 Nov 2019 06:29:09 GMT

All is well. I have managed to restart the server and the issue went away alongside it. Thank you so much

Re: Phantom Play Book Editor, Debugger Problem. Please Help

ansusabu — Mon, 18 Nov 2019 04:57:14 GMT

duplicate question:

https://answers.splunk.com/answers/783481/vpe-debugger-issue-no-response-on-test.html#answer-783484