Splunk® SOAR (On-premises)

Release Notes

The visual editor for classic playbooks was removed from Splunk SOAR in release 6.4.0. Convert your classic playbooks to modern mode. Your classic playbooks will continue to run and you can view and edit them in the SOAR Python code editor.
For details, see:

Known issues for

Release 6.4.0

Splunk SOAR version 6.4.0 includes the following known issues.

Date filed Issue number Description
2025-03-05 PSAAS-22290 Server side database connection terminations are not gracefully handled by add_to_searchindex
2025-02-24 PSAAS-22171 If a JSON file with binary data is located in a connector's directory, BaseConnector might crash
2025-01-29 PSAAS-21645 VPE Data Preview: Quick action menu does not produce usable data paths in real view

Workaround:
Use the copy button instead of the quick action menu.
2025-01-23 PSAAS-21528 Saving classic playbook shows Playbook Run Statistics modal but doesn't update code once accepted
2025-01-23 PSAAS-21530 VPE decision block shows invalid warning "Missing comparison value" when there is an "else" condition
2024-11-20 PSAAS-20760 Restarting phantom with telemetry off stops logs from being written to spawn.log
2024-11-06 PSAAS-20435 Looping functionality does not wait during "empty parameters list was passed to phantom.act()." error
2024-07-25 PSAAS-18798 VPE: Missing data paths in prompt block
2024-02-22 PSAAS-16477 Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes

Workaround:
Manually change the image: line in docker-compose.yaml to point to docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2023-12-11 PSAAS-15750 VPE: Downstream block invoked twice from join between two upstream code blocks

Workaround:
Detach one of the upstream blocks and run the blocks in sequence to avoid a join.
2023-06-12 PSAAS-13720 VPE: Playbooks become unresponsive when using an input playbook with "" in the name

Workaround:
Give the Playbook Action Block in the Automation Playbook a Custom Name that does not contain "[]" chars before having a filter reference the output of the Playbook Action Block.
Last modified on 06 March, 2025
Welcome to Splunk SOAR (On-premises) 6.4.0   Fixed issues for

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.4.0


Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters