Splunk® SOAR (On-premises)

Build Playbooks with the Playbook Editor

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

Create custom lists for use in playbook comparisons

A custom list is a collection of values that you can use in a playbook, such as a list of banned countries, or blocked or allowed IP addresses. Custom lists are used to save information in a visual format that can be used to make decisions or track information about playbooks. In your Filter and Decision blocks, compare parameters against all the values in a custom list, rather than having to configure each comparison in the playbook.

See Example of using a custom list in a filter for an example of how to use a custom list in a playbook.

Create a custom list in

Custom lists have a size limit of 2GB.

Perform the following steps to create a custom list in :

  1. From the Home menu, select Playbooks.
  2. Select the Custom Lists tab.
  3. Click + List to create a new list.
  4. Enter a name for the list.
  5. Enter or paste the list values in the table using one value per cell. For example, you can create a list of banned countries, or blocked or allowed IP addresses. Right-click in a cell to add or remove rows and columns.
  6. Click Save.

Import a custom list to using a CSV file

Imported custom list files have a size limit of 1MB.

Perform the following tasks to import a CSV file to be used as a custom list.

  1. From the Home menu, select Playbooks.
  2. Select the Custom Lists tab.
  3. Click the Import Custom List CSV icon (The Import Custom List CSV icon) to import a custom list as a CSV file.
  4. Enter a name for the list.
  5. Drag and drop your CSV file to the window, or click the window to locate the CSV file on your file system.
  6. Click Upload.
Last modified on 07 March, 2023
Use keyboard shortcuts in the classic playbook editor   View the list of configured playbooks in

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.5.0, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters