Splunk SOAR

How to go through a list where each item is the input for a child playbook that return a json object?

nongingerale
Explorer

Hi all! I'm trying to go through a list where each item is the input for a child playbook that return a json object. When I try to run it though, I receive this in the logs: "Ignoring child playbook <name of playbook> completion message since this playbook is already marked completed with status: success".

so then I tried using phantom.playbook() instead, but then the results variable doesnt include this json object even though the child playbook has that as an output.

What am I doing wrong or how can I make either option work for looping a child playbook? Thanks for any input!

Tags (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

Looping is not supported, yet, in the platform. 

There was an announcement at .Conf23 that stated a Loop Block was coming soon. I would highly recommend waiting for that. 

Also @nongingerale why are you not just passing all the items into the child playbook and then looping through the values inside the playbook? This is most certainly best practise for this. I appreciate I don't know your use case but there are many ways to not need to build bespoke loops using the platform capabilities. 

0 Karma

Erick995
Engager

When a playbook execution is complete, soar marks it as completed, what you have to do is call another playbook name, creating a dynamic variable that is added to your playbook name like this, according to your loop, you will call playbook1, playbook2, playbook3, etc.

0 Karma

prasanthkota
Engager

I am also having a similar issue, pls let us know if you have a solution.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...