Splunk Phantom

Getting error when trying to check if IP is local and make two separate queries to the CrowdStrike app.

New Member

Hi everyone,

It might me a silly question 🙂

The simplified case.

3 artifacts within the event with 3 different IP addresses:


I'm trying to check if IP is local and make separate queries to the crowdstrike (it could be any other app).



Each query should use filter parameter local_ip:"{0}", so I'm using a Format gadget.



I'm getting  a error during the execution because "Format" function returns joined value: local_ip:",".  And then it launches crowdstrike app just ones with this filter. But it should be 2 different request with a separate IP address in each one.

I tried to use as a filter parameter for the crowdstrike app:

  • "format_2:formatted_data.*" - returns None
  • "format_2:formatted_data" - returns "," as one string

So, how to make 2 different requests here?


Labels (1)
0 Karma


@Izzet if you use the format block's list interpretation (https://docs.splunk.com/Documentation/Phantom/4.9/PlaybookAPI/PlaybookAPI#format) then you can use the .* output. 
In your format block you should put:


Then when you use the .* output the action block knows it's getting a list and will create the relevant for loop to iterate though each one. 

As a side note, did you know the filter/decisions are CIDR aware? So you can use them to determine if they are in a known CIDR range (internal/RFC1918) or not without a custom function 😄 

For example you can put the IP (single or list) into the top field in a filter/decision condition, then use 'is in' then put the CIDR range in the final condition field, see below:

is in

If this helped please drop a like below!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!