Hey Manoj, You have two options: You can use an external search configuration to stream phantom data to Splunk and get that information on phantom_action_run or phantom_app_run indexes. I particularly use this one, and I see that phantom_action_run has the info you want to see. OR You can query Phantom REST api directly to get that information using the endpoints action_run, app_run or playbook_run for example. (https://docs.splunk.com/Documentation/SOARonprem/5.3.3/PlatformAPI/RESTQueryData) ... View more