Splunk SOAR

How to get output data when calling a playbook through the API

N_K
Engager

I have an input playbook with two output variables. I can retrieve these variables when I call the playbook using the playbook block in the UI.

However, I now need to loop over items in a list and call the playbook for each item in that list, this requires using the phantom.playbook function. From what I can see, there is no way to retrieve the output of this playbook now, is that correct?

 

Example below:

for item in prepare_data__post_list:
phantom.playbook(playbook="local/__Post_To_Server", container={"id": int(container_id)}, inputs={"body": item, "headers": prepare_data__headers, "path": prepare_data__path})
Labels (2)
0 Karma

churyn_splunk
Splunk Employee
Splunk Employee

You can do this without custom code and without calling a child playbook.

With your list, use format block with %% in front and after  you format your API to then call HTTP app's action using format_1:formatted_data.* (important you pass in the formatted data using the formatted_data.* with asterisk) to the http action. This will cause the http action to be triggered once for each item in the list.


0 Karma

phanTom
SplunkTrust
SplunkTrust

@N_K  You can make an action block loop through a list of parameters with the right input from a format block. With the HTTP app it may be harder to do as there are a lot of potential parameters. 

Yeah, please don't try to use requests outside of an app space 😄 

Depending what you are using the HTTP app for it may be best to build an app to handle it as you get a lot more control over the behaviour and the HTTP app, IMO, is usually only useful to test interactions with external APIs OR simple HTTP related tasks. 

How many parameters are dynamic when using the HTTP app? 

0 Karma

phanTom
SplunkTrust
SplunkTrust

@N_K I would recommend that you make the input playbook capable of handling list items as inputs and doing the iteration inside the playbook as it will be the path of least resistance and put less strain on the platform from a worker perspective. 

0 Karma

N_K
Engager

@phanTom Thanks for the reply. Unfortunately the input playbook contains a http app block. I've tried to just make the request in a code block using requests but am running into proxy errors, works fine when I use the app.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...