Splunk SOAR

Deleting Custom List Items

CS_
Path Finder

In a playbook, I have a decision tree.

If option A -> Check List -> If Value Exists in custom list -> Do Nothing

Else If Option b -> Check list -> If Value Exists in custom list -> Delete that list entry.

Checking in the SOAR Phantom app actions, I see several options for lists, but no option to "remove/delete listitem" (see attached pic)


How do I go about deleting items from a Custom List?

Thanks!

(SOAR Cloud 5.3.1)

 

 

Labels (2)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@CS_ 

There is an API to perform this in a code block or custom function:

https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#delete_from_list 

Otherwise you can rebuild the list without the value(s) and then use set_list to overwrite: 

 https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#set_list 

-- Hope this helps, if so consider leaving some Karma. Even better is if this fixed your issue, that you mark as a solution for others to find. Happy SOARing!! ---

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@CS_ 

There is an API to perform this in a code block or custom function:

https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#delete_from_list 

Otherwise you can rebuild the list without the value(s) and then use set_list to overwrite: 

 https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/DataManagementAPI#set_list 

-- Hope this helps, if so consider leaving some Karma. Even better is if this fixed your issue, that you mark as a solution for others to find. Happy SOARing!! ---
0 Karma

CS_
Path Finder

@phanTomAs always, you've dropped the perfect answer. Many thanks!

I'll give this a try (from the first URL you provided)

phantom.delete_from_list(list_name=None, value=None, column=None, remove_all=False, remove_row=False)

 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...