How can a playbook run searches on a Splunk search head?

Question

Options

• AUsing the search action of the Search app.
• BUsing the run_query action from the Splunk app.
• CUsing the phantom.run_query() API function.
• DUse the HTTP app's get_data action to access the SOAR .../rest/splunk/query endpoint.

• A
  2% (1)
• B
  91% (41)
• C
  4% (2)
• D
  2% (1)

Explanation

Option B is correct because Splunk SOAR ships with a dedicated Splunk app whose run_query action is purpose-built to send SPL searches to a configured Splunk search head and return results - this is the official, supported integration path.

Why the distractors fail:

• A is wrong because there is no "Search app" in SOAR with a "search action"; this conflates the Splunk app's real name with a fictional one.
• C is wrong because phantom.run_query() is not a real SOAR Python API function; the phantom module exposes functions like phantom.act() and phantom.collect2(), not a run_query helper.
• D is wrong because routing through the HTTP app to hit an internal SOAR REST endpoint is not how Splunk integration works - no /rest/splunk/query endpoint exists in SOAR for this purpose.

Memory tip: Think "Splunk app → Run Query" (SRQ). The app name matches the platform you're querying, and the action name literally says what it does - making B the only choice that names both correctly.

No community discussion yet for this question.