Which of the following queries would return all failed playbook runs from the REST API?

Question

Options

• Ahttps://<PHANTOM_URL>/rest/playbook_run?_filter_status failed
• Bhttps://<PHANTOM_URL>/rest/playbook_run?_filter_status "failed"
• Chttps://<PHANTOM_URL>/rest/playbook_run?_search_status=failed
• Dhttps://<PHANTOM_URL>/rest/playbook_run?_query_status="failed"

• A
  9% (4)
• B
  13% (6)
• C
  4% (2)
• D
  74% (35)

Explanation

Option D uses the correct Phantom (Splunk SOAR) REST API filter syntax: the _filter_ prefix with proper = assignment and the value enclosed in double quotes - _filter_status="failed" is the established pattern, and _query_ follows the same valid convention with properly structured key=value syntax.

Option A fails because it has no = sign and no quotes, leaving the URL malformed - the parser cannot distinguish the parameter name from its value. Option B is similarly broken: the space between _filter_status and "failed" means the value is never actually assigned to the parameter (the = is missing). Option C uses _search_, which is a full-text search prefix, not a field-level equality filter - it would search across fields broadly rather than matching the status field exactly.

Memory tip: Think of REST filter parameters like assignment statements - you need a key, an =, and a quoted string value. If any of those three pieces is missing or replaced with the wrong prefix (_search_ instead of _filter_/_query_), the query won't work as intended.

No community discussion yet for this question.