Create a playbook in Splunk Phantom to use in the Splunk AR Workflow Automation feature

Workflow Automation is a beta feature available in Splunk AR version 2.1.0 and later. Workflow Automation integrates Phantom playbooks into AR workspaces to guide users through real-world tasks. To use Workflow Automation, create playbooks in Phantom and then add them to your AR workspaces in the Splunk AR mobile app.

For example, you can use Workflow Automation to guide a maintenance worker through servicing a sensor. Suppose the worker needs to check if a temperature sensor works properly. You can create a playbook to instruct the worker to check if the sensor has a reading, use their own thermometer to check if the readings match, and file a ticket if the sensor doesn't work.

Prerequisites

Before using Workflow Automation in Splunk AR, complete the following tasks:

• Set up Splunk AR and AR workspaces. See Set up Splunk AR in the Get started with Splunk AR topic.
• Install Splunk Phantom. See Get Splunk Phantom for more information about installing Splunk Phantom.
• Make sure users who are using Workflow Automation have registered their devices to a Splunk instance. See Register your device in Use Splunk Cloud Gateway to register to a Splunk instance.
• Make sure you and your Splunk AR users have the right permissions. See Manage roles and permissions in Splunk to learn about Splunk Phantom permissions and see Configure Splunk AR permissions to learn about about playbook permissions in Splunk AR.
• Enable the Workflow Automation feature on user devices.

Create a sensor maintenance flow playbook in Splunk Phantom for Workflow Automation

Here's how to create a simple maintenance flow playbook for workflow automation. These steps follow a temperature sensor maintenance flow example.

To add a new block to a playbook, drag the half-circle icon attached to any block on the canvas. Release your mouse to create a new empty block connected to the originating block with an arrow.

See Create and debug playbooks in Splunk Phantom using the visual playbook editor in Use Splunk Phantom for detailed information about creating playbooks.

Check if the sensor has a reading

Ask the worker if the sensor has a reading.

1. Navigate to the Playbooks page.
2. Click + Playbook.
3. Create a prompt block. Drag the green half-circle on the START block to create prompt 1.
   1. Assign admin as the approver.
   2. Write a message: Write "Does the sensor have a reading?"
   3. Add a response. Select Yes/No as the response type.

Measure temperature manually

Set up a decision tree.

1. Create a decision block. Drag the green half-circle on decision 1 to create prompt 2.
2. Select if prompt_1:action_resultsummary.responses0.
3. Enter == Yes.
4. Click Add Else.

If the sensor has a reading, tell the worker to measure the temperature with their own thermometer.

1. Drag the green half-circle on decision 1 to create prompt 2.
2. Assign admin as the approver.
3. Write a message: Write "Measure the temperature with your own thermometer."
4. Add a response: Select Custom List as a response type and enter the value OK.

Cross check the sensor reading

Set up a decision tree.

1. Drag the green half-circle on prompt 2 to create prompt 3.
   1. Assign admin as the approver.
   2. Write a message: Write "Does your reading match the sensor reading?"
   3. Add a response: Select Yes/No.

Ask the worker if the sensor reading matches the reading on their thermometer.

1. Drag the green half-circle on prompt 3 to add decision 2.
2. Select if prompt_1:action_resultsummary.responses0.
3. Enter == Yes.
4. Click Add Else.

File a ticket if the sensor doesn't work

If the sensor does not have a reading, or if the sensor reading does not match their thermometer reading, tell the worker to file a ticket.

1. drag the purple half-circle on decision 1to create prompt 4.
   1. Assign admin as the approver.
   2. Write a message: Write "Sensor needs repair. File a ticket."
   3. Add a response: Select Custom List as a response type and enter the value OK.
2. Drag the purple half-circle on decision 2 to prompt 4.

To keep things simple, this example uses a prompt block to tell the worker to file a ticket. Depending on what you want to complete with this playbook, you can create any type of block, such as an action block or another playbook. Splunk Phantom integrates with various apps that let you take action outside of Workflow Automation. See Add and configure apps and assets to provide actions in Splunk Phantom to learn how to provide actions in a playbook. See Run other playbooks inside your playbook to learn how to add another playbook to your playbook.

Complete the playbook

1. Drag the green half-circle on decision 2 to create prompt 5.
   1. Assign admin as the approver.
   2. Write a message: Write "Done"
2. Drag the half green circle on prompt 4 to prompt 5.
3. Drag the green half-circle on prompt 5 to the END block.

Add the playbook to a workspace in the Splunk AR app

See Add Phantom playbooks to AR workspaces in Splunk AR to learn how to use Workflow Automation in the Splunk AR app.