View or edit the Python code in Splunk SOAR (Cloud) playbooks

In the Data preview panel of the Visual Playbook Editor, select the Python Playbook Editor tab to view the underlying Python code for your playbook. The code for the entire playbook is shown by default. Select any block in your playbook to view the code for the selected block only.

See the following documentation for more information about the Data preview panel and Python code in your playbooks:

Note: Splunk does not support custom Python packages.

Manage your editing session

Use the icons in the Python Playbook Editor to manage your editing session.

Icon Description
The view full playbook icon View the Python code for the entire playbook. Using this icon is useful if you are viewing the Python code for a specific block on the canvas, and want to return to view the Python code for the entire playbook.
The view selected block icon View the Python code for the selected playbook block. Using this icon is useful if you are viewing the Python code for the entire playbook, and want to view the Python code for the selected playbook block.
The view block looping icon View looping logic for the selected playbook block, if any exists. Using this icon is useful if you want to focus on the looping functionality of the selected playbook block.
The view callback icon View callback function for the selected block. The callback function is used to view to the block of code that is generated to split the output of the single block into multiple blocks.
The view join function icon View join function for the selected block. The callback function is used to view to the block of code that is generated to join the output of the multiple blocks into a single block.
The global code icon Add code that needs to be defined at the global level of the playbook, inserted below import statements for Python libraries.
The text wrap icon Select to wrap lines of text. Select again to stop line wrapping.
The revert changes icon Go back to the original version and discard all changes. If there are changes to revert, the button turns white when you hover over it.

Search and replace in the Python editor

Use keyboard shortcuts to find, or find and replace, specific parts of your code.

Note: If you are using a Windows or Linux machine, make the following substitutions in the keyboard shortcuts:

replace Command with Control; replace Option with Alt

Find code

To find code in the Python editor, follow these steps:

  1. Select the search icon image of magnifying glass icon used to search Python code or press the Command and F keys on your keyboard.
    The Search field appears above the code in the editor window.
  2. Enter your search term as a string. If you are searching by using a Python regular expression, use /re/ syntax.
  3. Press the Enter key to see search results highlighted. Refer to the table for additional actions.

Find and replace code

To find and replace code in the Python editor, follow these steps:

  1. Press the Command, Option, and F keys simultaneously on your keyboard.
    The Replace field appears above the code in the editor window.
  2. Enter your search term as a string. If you are searching by using a Python regular expression, use /re/ syntax. Press the Enter key on your keyboard. The Replace field is now labeled With.
  3. In the With field, enter the term you want to use as a replacement term. Press the Enter key on your keyboard. Several options appear.
  4. Select one of the options to complete, or cancel, the replacement:
    • Yes: performs the substitution at the first highlighted location
    • No: skips the currently highlighted location and moves to the next highlighted location
    • All: performs the substitution at all highlighted locations
    • Stop performs no substitutions and exits the replacement field

Keyboard shortcuts

Use the following keyboard shortcuts for related actions.

Description Shortcut
Find Command + F
Find next Command +G
Find previous Command + Shift + G
Replace Command + Shift + F
Replace all Command + Shift + Option + F
Jump to line Option + G

How custom Python edits affect the visual playbook editor

When you see Playbook Code in the Python Playbook Editor, you are making changes affecting the whole playbook. When you begin to make edits, you are prompted to verify that you want to continue. If you continue, you will no longer be able to edit the playbook using the playbook editor. All changes to the playbook must be made by editing or adding Python code.

If you select a block in the playbook, your edits disable the playbook editor only for that block. The Python Playbook Editor changes from Playbook Code to the name of the Python function called in that block. You can continue to use the playbook editor to add, edit, or delete other blocks in the playbook. If you want to add another block downstream from the block you edited, you must manually enter a Python function call for the next block, such as phantom.act(). The playbook editor doesn't generate Python code for any block containing custom edits.

When editing the Python code for a Code block, make your edits in the editable area in order for callback functions to work.

  1. Create a Code block in the playbook editor. See Add custom code to your Splunk SOAR (Cloud) playbook with the code block.
  2. Select Python Playbook Editor.
  3. Select the Code block.
  4. Write your custom code in the area with the # Write your custom code here... text. 
    ################################################################################
## Custom Code Start
################################################################################

# Write your custom code here...

################################################################################
## Custom Code End
################################################################################