You can do this without custom code and without calling a child playbook. With your list, use format block with %% in front and after  you format your API to then call HTTP app's action using format_1:formatted_data.* (important you pass in the formatted data using the formatted_data.* with asterisk) to the http action. This will cause the http action to be triggered once for each item in the list. ... View more

Make sure you are setting a valid label for the container.  Also, double check for valid severity and sensitivity being set on container.   You can check for errors when Splunk tries to create container in SOAR. Run this SPL: index=cim_modactions error ... View more

No. This administrative procedure moves the index files "underneath the hood" so to speak. The files are already parsed and do not go through the parsing/indexing phase again. Thus, no license meter. ... View more

You can use tokens: https://docs.splunk.com/Documentation/Forwarder/6.4.1/Forwarder/Controlforwarderaccess ... View more