I have a playbook using the Splunk "run query" action block with the "attach_result" action which adds the query results to the vault. Is there any way to download these results locally using the same playbook as opposed to manually navigating to each container and downloading the results? I have a scenario where I would like to download these files from the container as they run and then place them on a shared drive (or moving the file from the Phantom box to the shared drive would work great as well).
It seems like it should be simple, but I cannot figure out how to interact with this file using a playbook. Any help would be appreciated!
