Splunk® Phantom (Legacy)

Administer Splunk Phantom

Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.

View the playbook run history in Splunk Phantom

You can view the history of playbook runs on your Splunk Phantom instance.

  1. From the Main Menu, select Administration.
  2. Select System Health > Playbook Run History.

The Playbook Run History page displays a sortable table of playbook runs. Each column except for Git Commit is sortable. The table displays the following columns:

Column title Description
Name The name of the playbook that was run.
Run ID The numeric ID of the Playbook Run.
Event ID The numeric ID of the event the playbook was run against.
Label The label the playbook was run against, such as event.
Start Time The time the playbook was started.
End Time The time the playbook run finished.
Status Whether the playbook run succeeded or failed.
Git Commit The Git commit ID from when the playbook version was committed to the included Git source control module.
Run By The name of the user who ran the playbook.
Last modified on 25 January, 2020
Locate long-running playbooks for debugging or troubleshooting in Splunk Phantom   View the action run history

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters