Pass format block data to subplaybook

[shaquibk]

Hi Team,

I want to know if it is possible pass data present in a format block of one playbook to another playbook being called. So its like

PB1--->Format block -------> PB2 called ------>PB2 performs functions on the previous format block data.

I know as a workaround this can be done by adding an artifact and using it in subplaybook. But would prefer if it is possible without it.

Kindly let me know if any further info is required.

Thanks in advance!

Regards,

Shaquib

[phanTom]

@shaquibk you could look to use phantom.save_object() and phantom.get_object() to save and retrieve the formatted string in another playbook. Not sure if the process will mess with formatting but they will certainly persist the formatted data string for re-use.

save_object() : https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/DataManagementAPI#save_object 

get_object(): https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/DataManagementAPI#get_object 

Happy Phantoming!