I currently have a playbook that runs 3 actions within it (creating a splunk search, sharing the job, and expanding ttl, all while using the loop-if-failure feature) and returns outputs (summary, status, and the search results). I'm trying to do a for-loop where it calls that playbook with different params using phantom.playbook() though I am having trouble finding the actual playbook output in the callback function.  Example: for loop:      inputs = {<changing params>}      new_name = "<changing string>"      phantom.playbook("my_playbook", container=container, name=new_name, input=inputs, callback=my_callback) where in my_callback:    I try phantom.collect2(container=container, datapath=["new_name:playbook_output:search_results_data"], action_results=results) which doesnt work. I tried printing out general "results" which gives me info such as: name playbook playbook_run_id result (which contains a dictionary for info on each of the 3 actions) but this doesnt include the output data of the playbook itself (or the run_query splunk search results).  I did see a past post that didnt get an answer (or at least not the answer that fits my scenario: https://community.splunk.com/t5/Splunk-SOAR/How-to-get-output-data-when-calling-a-playbook-through-the-API/m-p/698278). My use case needs to use the subplaybook and not the actions directly due to configuration reasons (mainly the asset field needs to be configurable rather than hard-set via the Splunk App runquery action block). any help or direction would be super appreciated! ... View more

What would be the best way, if any, for SOAR to check if a Splunk search is complete/finalized instead of actively running? I see a dispatchState var (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-tutorials/9.4/rest-api-tutorials/creating-searches-using-the-rest-api) but would like some guidance on how to check this from a soar playbook. Thanks! ... View more

Hey there! I'm currently struggling to find a way to send the alert sid (commonly found under view results when using the Send Email action in the Alert config) to SOAR. Currently I'm able to send the results as multiple artifacts within 1 container via the Grouping checkbox. However if I have a result that holds over 5k+ events, then a container will hold 5k+ artifacts. What's interesting is that in each artifact within the container, there's a variable named _originating_search that has the SID I want to pass. Right now I only want this result sid (_originating_search) but I cant figure out how to do this. Any suggestions welcomed! ... View more

Hi all - is there a way for us to check/test connectivity across a list of assets from within a playbook? I was looking through the documentation and haven't found information that says it is possible or not. I only see how to do it manually or with the rest api call app_status but no examples on how to use it within a playbook. Any help is appreciated! ... View more

Hi all! I'm trying to go through a list where each item is the input for a child playbook that return a json object. When I try to run it though, I receive this in the logs: "Ignoring child playbook <name of playbook> completion message since this playbook is already marked completed with status: success". so then I tried using phantom.playbook() instead, but then the results variable doesnt include this json object even though the child playbook has that as an output. What am I doing wrong or how can I make either option work for looping a child playbook? Thanks for any input! ... View more

Probably a silly question but for the life of me can't find documentation - when we create a code block, how do we call the the name of said code block? Currently want to add extra information in my error handling and want to include the name of the code block that it occurs under. I tried variations of phantom.name, custom_function__name, custom_function.name/(), self.name, etc. Any help is appreciated! ... View more