Splunk SOAR

Running a playbook without Event id?

ansir
Explorer

Hi,

i'm trying to create a set of playbooks to unit test other playbooks.

 

is it possible to run a playbook without providing an event id?

 

thanks.

 

Ansir

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@ansir a playbook must have either a container id or artifact id to run against. 

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

 

Hope this helps! Happy SOARing!

 

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@ansir a playbook must have either a container id or artifact id to run against. 

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

 

Hope this helps! Happy SOARing!

 

0 Karma
Get Updates on the Splunk Community!

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...