Splunk SOAR (f.k.a. Phantom)

Using current container info in a custom function



Within a Custom Function, is it possible to grab information from the current container? For example, I've added this line to a function:

from_address = str(phantom.collect2(container=container, datapath=["artifact:*.cef.fromEmail"], limit=1)[0][0])

Ideally the value of the variable would just be a string of an email address. But I get an error that the variable "container" hasn't been defined.

However, when I test this line in the "custom code" section of a function block within a playbook, it works fine. 

Any thoughts on how I can achieve this? Thanks!

Labels (1)

Splunk Employee
Splunk Employee


You'll need to pass in container as a parameter to your function. Here is an example of what I believe you are trying to do:



Notice I have a parameter to the custom function called 'container'. I pass that in like this:



With the container available in the CF, you can use collect2 as expected. Interestingly, notice line 17 on the first screenshot. We have to do "container=container[0]" because the Container parameter of collect2 expects a dict but the data comes in as a list, so we have to extract the dict from the list's first element.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...