Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.
View the action run history
You can view the history of actions run on your Splunk Phantom instance.
- From the Main Menu, select Administration.
- Select System Health > Action Run History.
The Action Run History page displays a sortable list of action runs. Each column except for View Results is sortable. The table displays the following columns:
| Column name | Description |
|---|---|
| Name | The name of the action that was run. |
| Run ID | The numeric ID of the action that was run. |
| Event ID | The numeric ID of the event the action was run against. |
| Start Time | The time the action started. |
| End Time | The time the action finished. |
| Status | Whether the action succeeded or failed. |
| Prompted | If the action taken was a prompt or manual task action, the ID of the user assigned the action appears here. |
| Run By | The name of the user who ran the action. |
| View Results | A hyperlink to the action results in Investigation. For prompt or manual task actions, the link opens a window containing the prompt or task results. |
Last modified on 25 January, 2020
| View the playbook run history in Splunk Phantom | Use ITSI to monitor the health of your deployment |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7
Download manual
Feedback submitted, thanks!