Splunk® SOAR (On-premises)

Build Playbooks with the Playbook Editor

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Run other playbooks inside your playbook using the classic playbook editor

You can configure your playbook to run another existing playbook. Call one playbook from another playbook to avoid having to copy and maintain code in different places.

To configure your playbook to run another playbook:

  1. Drop a new block onto the playbook editor.
  2. Click on the block, then select Playbook from the block types.
  3. In the Playbook field, select the playbook you want to run from the drop-down list.
  4. (Optional) Toggle the Synchronous switch on to make this playbook wait for the called playbook to complete running before continuing.

Playbooks differ from action blocks in the following ways:

  • The playbook continues to downstream blocks regardless of whether the called playbook is successful.
  • The called playbook doesn't return any values that are used in downstream blocks.
  • The called playbook doesn't determine the data set, and it operates on the container data with the scope inherited from the caller.
  • The called playbook runs independently from the caller. If you wire a series of playbooks to run, they are processed in parallel if the Synchronous switch is left off. See Determine your playbook flow.
Last modified on 19 October, 2021
PREVIOUS
Set container parameters in using the API block with the classic playbook editor
  NEXT
Add custom code to your playbook with the custom function block using the classic playbook editor

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.4.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters