A better way to approach this is to use inputlookup as your command rather than search For example to run | inputlookup my_list.csv | search blah... Configure your action block like this command: inputlookup query: my_list.csv | search blah...  this runs the query as expected in Splunk as | inputlookup my_list.csv  Many commands are valid to use which are not listed in the app just as make results and collect etc which are super handy to run in SOAR playbooks! ... View more