Splunk® SOAR (On-premises)

Build Playbooks with the Playbook Editor

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Export and import playbooks in

You can export, or download, and import, or upload, playbooks in to share them with other tenants.

Export a playbook to your local filesystem

Perform the following tasks to export a playbook from the playbooks table. The playbook is downloaded as a JSON file to your local filesystem.

  1. From the Home menu, select Playbooks.
  2. Select the checkbox for the playbook you want to export.
  3. Click Export.

You can also export a playbook while you are editing the playbook in the playbook editor. In order to export a playbook, you must save it at least once. The export will download the latest saved version of the playbook.

Perform the following tasks to export a playbook from the classic playbook editor:

  1. Make sure there is at least one saved version of the playbook.
  2. In the playbook editor, click Playbook Settings.
  3. Click Export Playbook.

Perform the following tasks to export a playbook from the modern playbook editor:

  1. Make sure there is at least one saved version of the playbook.
  2. In the playbook editor, click the more icon ( Vertical version of the more icon. ).
  3. Click Export.

Import a playbook to

Perform the following tasks to import a playbook. The imported playbook is treated as a new playbook.

  1. From the Home menu, select Playbooks.
  2. Click the Import Playbook icon (The Import Playbook icon) to add a playbook to .
  3. Set the source control repository to which the playbook will be uploaded.
  4. (Conditional) If you are uploading a playbook with the same name as an existing playbook, check the Force Update checkbox.
  5. Drag and drop your .tgz compressed playbook file onto the Select Playbook Archive field, or click that field to browse to select the playbook archive from your file system.
  6. Click Upload.
Last modified on 30 August, 2022
View the list of configured playbooks in   Manage settings for a playbook in

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2, 5.3.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters