Splunk SOAR (f.k.a. Phantom)

How to go through a list where each item is the input for a child playbook that return a json object?

nongingerale
Explorer

Hi all! I'm trying to go through a list where each item is the input for a child playbook that return a json object. When I try to run it though, I receive this in the logs: "Ignoring child playbook <name of playbook> completion message since this playbook is already marked completed with status: success".

so then I tried using phantom.playbook() instead, but then the results variable doesnt include this json object even though the child playbook has that as an output.

What am I doing wrong or how can I make either option work for looping a child playbook? Thanks for any input!

Tags (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

Looping is not supported, yet, in the platform. 

There was an announcement at .Conf23 that stated a Loop Block was coming soon. I would highly recommend waiting for that. 

Also @nongingerale why are you not just passing all the items into the child playbook and then looping through the values inside the playbook? This is most certainly best practise for this. I appreciate I don't know your use case but there are many ways to not need to build bespoke loops using the platform capabilities. 

0 Karma

Erick995
Engager

When a playbook execution is complete, soar marks it as completed, what you have to do is call another playbook name, creating a dynamic variable that is added to your playbook name like this, according to your loop, you will call playbook1, playbook2, playbook3, etc.

0 Karma

prasanthkota
Engager

I am also having a similar issue, pls let us know if you have a solution.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...