Splunk SOAR

How to continue playbook after failed action run?

kblaine
Explorer

I am writing a playbook that loops through a list of case ids to delete. This action fails after hitting 50 for the action and I have written in my playbook to continue if there are still valid ids left in the list. However, after the failed it won't continue down to the code to what I have written down below to remediate. How can I get the playbook to continue after a failed action and just mark it failed rather than exiting the playbook?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...