Splunk® SOAR (On-premises)

Release Notes

As of version 6.4.0, the visual editor for classic playbooks is no longer part of Splunk SOAR. Before upgrading, convert your classic playbooks to modern mode. Your classic playbooks will continue to run and you can view and edit them in the SOAR Python code editor.
For details, see:

Fixed issues for

June 10, 2025 Release 6.4.1

Workaround for PSAAS-23968: Required Join settings ignored due to switch from functionName to id in notRequiredJoins list For most users, no action is required. To determine if you must take action to update your playbooks, continue reading in this section.

For Splunk SOAR (On-premises) version 6.4.1.361. Check that your stack has been updated to this exact build number before proceeding.

An emergency update was emailed to you on May 30, 2025. If you already updated your affected playbooks by following the instructions in that email, no further action is required.

If you have playbooks that meet both of the following criteria, you must take further action:

  • Created in a version earlier than version 6.4.1 AND
  • Configured or updated join settings and saved after upgrading to version 6.4.1

For additional details on join settings, see Advanced settings in the Add a new block to your Splunk SOAR (On-premises) playbook document.

To update playbooks that meet the criteria just described, follow these steps.

  1. Open a playbook that meets the criteria.
  2. In the Visual Playbook Editor, review playbook blocks for which you configured or updated join settings. Ensure that the join settings are configured appropriately.
  3. Save the playbook.
  4. Repeat these steps for each affected playbook.

Release 6.4.1

Splunk SOAR version 6.4.1 includes fixes for the following issues.


Date resolved Issue number Description
2025-06-04 PSAAS-23878 Deadlock occurs in IngestD due to an issue in the cleanup ingestion_status records logic causing excessive deletes
2025-06-03 PSAAS-23968 Required Join settings ignored due to switch from functionName to id in notRequiredJoins list
2025-04-16 PSAAS-22553 VPE: Could not run classic VPE playbook after it's opened; Need to save first
2025-04-15 PSAAS-22900 Deleting the internal SystemSettings.email_asset object cascades, deleting all SystemSettings objects.
2025-04-14 PSAAS-22654 Improve logging around postgres 'bad record mac' errors which occur when pulling data which is too large for RDS
2025-04-08 PSAAS-22217 Notes editing in events reverts if you switch tabs before saving
2025-04-02 PSAAS-22171 App packaged on MacOS: App's TGZ file might contain MacOS metadata, so SOAR cannot load the app's JSON
2025-03-18 PSAAS-20435 Looping functionality does not wait during "empty parameters list was passed to phantom.act()." error
2025-03-05 PSAAS-17481 Spawn.log does not populate after disabling telemetry and restarting Spunk SOAR
2025-03-04 PSAAS-14209 Asset health marked incorrectly "failed" sometimes (SMTP, custom apps)
2025-02-03 PSAAS-21645 VPE Data Preview: Quick action menu does not produce usable data paths in real view
Last modified on 17 June, 2025
Known issues for   Compatibility with related Splunk products

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.4.1

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters