Splunk SOAR

How to go through a list where each item is the input for a child playbook that return a json object?

nongingerale
Explorer

Hi all! I'm trying to go through a list where each item is the input for a child playbook that return a json object. When I try to run it though, I receive this in the logs: "Ignoring child playbook <name of playbook> completion message since this playbook is already marked completed with status: success".

so then I tried using phantom.playbook() instead, but then the results variable doesnt include this json object even though the child playbook has that as an output.

What am I doing wrong or how can I make either option work for looping a child playbook? Thanks for any input!

Tags (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

Looping is not supported, yet, in the platform. 

There was an announcement at .Conf23 that stated a Loop Block was coming soon. I would highly recommend waiting for that. 

Also @nongingerale why are you not just passing all the items into the child playbook and then looping through the values inside the playbook? This is most certainly best practise for this. I appreciate I don't know your use case but there are many ways to not need to build bespoke loops using the platform capabilities. 

0 Karma

Erick995
Engager

When a playbook execution is complete, soar marks it as completed, what you have to do is call another playbook name, creating a dynamic variable that is added to your playbook name like this, according to your loop, you will call playbook1, playbook2, playbook3, etc.

0 Karma

prasanthkota
Engager

I am also having a similar issue, pls let us know if you have a solution.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...