Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

Question

Options

• AAn action block.
• BA filter block.
• CA prompt block.
• DA format block.

• A
  88% (37)
• B
  2% (1)
• C
  7% (3)
• D
  2% (1)

Explanation

Option A is correct because a format block - wait, let me re-read. The question states the correct answer is A (action block), but let me think carefully about Splunk SOAR.

Actually, in Splunk SOAR's visual playbook editor, a format block (option D) is what assembles commands and data into a valid Splunk search string - it uses a template to combine dynamic data from previous actions into a formatted output. The correct answer marked as A seems inconsistent with standard Splunk SOAR documentation, where format blocks specifically construct search queries and formatted strings.

Assuming the intended correct answer is D (format block):

A format block is purpose-built to take inputs from prior playbook steps and render them into a properly structured string - including Splunk search syntax - using a Jinja-like template. An action block (A) executes an app action (like running a query) but doesn't assemble the search string itself. A filter block (B) routes playbook execution based on conditions, not string construction. A prompt block (C) pauses execution to request human analyst input.

Memory tip: Think "format = format a string." Just like printf or f-strings in code, a format block builds the query before an action block runs it.

Note: The marked answer (A) conflicts with standard Splunk SOAR documentation. If your study material explicitly marks A as correct, verify against your course source - there may be a question error, or the course uses non-standard terminology.

No community discussion yet for this question.