Splunk® SOAR (Cloud)

Administer Splunk SOAR (Cloud)

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

View Playbook Run Statistics

Playbook Run Statistics are available in playbooks created in the Visual Playbook Editor, starting in version 5.3.3.

Learn how your playbooks are performing, and troubleshoot potential issues, by viewing Playbook Run Statistics. You can view statistics for specific playbook runs at the playbook level and for each block and custom function within a playbook after the playbook has run. Compare statistics for this playbook to other specific runs or to run averages for that playbook to detect differences.

To view the Playbook Run Statistics for one of your playbooks, complete these steps:

  1. Open the playbook within the Visual Playbook Editor.
  2. In the top right corner of the screen, click the more icon More Icon Image, then click View Run Statistics. The Playbook Run Statistics dialog box displays.
  3. In the first column in the Playbook Run Statistics dialog box, use the Playbook Run field to specify the playbook run you want to investigate. Use the filter to search for a specific run, if needed.
  4. (Optional) In the second column, choose whether you want to compare against the average runs for that playbook for the last 24 hours, 7 days, or all runs for that playbook.
  5. (Optional) Use the third column to add another comparison for the same playbook.
  6. (Optional) Add a fourth column by clicking the plus icon.
To show all available playbook run statistics, expand each of the sections in the dialog box.
To view information for a specific block in playbook, click that individual playbook block. In the left panel, click the Stats tab.

Playbook Run Statistics and older playbooks

Playbook Run Statistics are available in playbooks created in the Visual Playbook Editor, starting in version 5.3.3. To view these statistics with playbooks you created with the Visual Playbook Editor in versions lower than 5.3.3, you must first save the playbook to automatically add the code required for statistics. The added statistics code does not affect your custom code.
You can view statistics for these updated playbooks for runs performed after you have updated the code.

Description of Playbook Run Statistics

This table describes Playbook Run Statistics for playbook blocks.

Field Description
DB Queries Number of requests to the database made by this block
DB Query Latency Average amount of time for the block request to reach the database, in milliseconds
Duration Amount of time for the block to execute, in milliseconds
HTTP Bytes in Requests Number of bytes transmitted by the block through HTTP requests
HTTP Bytes In Response Number of bytes received by the block through HTTP requests
HTTP Latency Average amount of time between HTTP requests and responses experienced by the block, in milliseconds
HTTP Requests Number of HTTP requests initiated by the block
Times Called Number of times the block was called
Times Succeeded Number of times the block completed successfully

Playbook run statistics are enabled with the phantom.playbook_block() decorator.

Last modified on 06 November, 2024
View the playbook run history in   View the action run history

This documentation applies to the following versions of Splunk® SOAR (Cloud): current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters