Known issues for Splunk SOAR (On-premises)

Release 6.4.0

Splunk SOAR version 6.4.0 includes the following known issues.

Date filed Issue number Description
2025-05-28PSAAS-23878Deadlock occurs in IngestD due to an issue in the cleanup ingestion_status records logic causing excessive deletes
Workaround:
Open a support case for assistance with remediation.

See: Splunk Technical Support

2025-05-19PSAAS-23626Playbook prompt blocks: Response is required, regardless of "Required" field setting
2025-04-10PSAAS-22900 Deleting the internal SystemSettings.email_asset object cascades, deleting all SystemSettings objects.
2025-03-18PSAAS-22553VPE: Could not run classic VPE playbook after it's opened; Need to save first
Workaround:
Click "Discard Changes" button.
2025-03-03PSAAS-22258Report pdf fails to download
Workaround:
Take a snap of your environment before you follow these steps.
  1. Verify which wkhtmltopdf package to download.
    https://github.com/wkhtmltopdf/packaging/releases/0.12.6-1
  2. From the SOAR CLI download wkhtmltopdf: (example shown is for Centos/RHEL 8)
    wget https://github.com/wkhtmltopdf/packaging/releases/0.12.6-1/wkhtmltox-0.12.6-1.centos8.x86_64.rpm
  3. Yum install any required dependancies. (example shown is for a default install of Centos 8)
    yum install -y libX11 libXext libXrender libjpeg xorg-x11-fonts-75dpi xorg-x11-fonts-Type1
  4. Install wkhtmltopdf:
    rpm -Uvh wkhtmltox-0.12.6-1.centos8.x86_64.rpm
  5. Symlink wkhtmltopdf to /usr/bin:
    ln -s /usr/local/bin/wkhtmlto* /usr/bin/
  6. Restart SOAR. (example shown uses the default SOAR install path)
    /opt/phantom/bin/stop_phantom.sh && /opt/phantom/bin/start_phantom.sh
2025-02-24PSAAS-22171 App packaged on MacOS: App's TGZ file might contain MacOS metadata, so SOAR cannot load the app's JSON

Workaround: The problem stems from MacOS creating hidden files with binary data and ".json" extensions, with names that start with "._".

Workarounds include:
  • When creating a custom app package on MacOS, add a command line flag "--no-mac-metadata" to the tar command used to package the app. This will exclude the offending files from the package and allow it to function properly when uploaded to Splunk SOAR.
  • When an app containing these metadata files is packaged for export by the Splunk SOAR app editor, hidden files are ignored. So you can exclude the extraneous metadata files by exporting an existing app package from Splunk SOAR and reinstalling it via the package upload UI.

Note: If the affected app is configured to run on an Automation Broker, you might need to force the Automation Broker to redownload the app from SOAR by either incrementing the app's version number or by deleting the app's directory in your broker's "splunk_data" volume.

2025-01-29PSAAS-21645VPE Data Preview: Quick action menu does not produce usable data paths in real view
Workaround:
Use the copy button instead of the quick action menu.
2025-01-23PSAAS-21528Saving classic playbook shows Playbook Run Statistics modal but doesn't update code once accepted
2025-01-23PSAAS-21530VPE decision block shows invalid warning "Missing comparison value" when there is an "else" condition
2025-01-16PSAAS-21440VPE: Blocks in top right area of the canvas cannot be selected when there is an error message
Workaround:
Move the canvas to a location on your screen where blocks are not obscured by error messages.

To move the canvas, select a blank area of the canvas and drag it to another location on your screen.

2025-01-09PSAAS-21330VPE: Renaming a joined block causes the join settings to be invalid.
Workaround:

To update playbooks where you have renamed a block or updated join settings follow these steps.

  1. Open the affected playbook.
  2. In the Visual Playbook Editor, review playbook blocks for which you configured or updated join settings, or have renamed a block. Ensure that the join settings are configured appropriately.
  3. Save the playbook.
2024-11-20PSAAS-20760Restarting phantom with telemetry off stops logs from being written to spawn.log
2024-02-22PSAAS-16477Podman does not currently work with redirected image URLs due to Docker Hub authentication token changes
Workaround:
Manually change the image: line in docker-compose.yaml to point to 
docker.io/phantomsaas/automation_broker:<$SOAR_VERSION>.
2023-12-11PSAAS-15750VPE: Downstream block invoked twice from join between two upstream code blocks
Workaround:
Detach one of the upstream blocks and run the blocks in sequence to avoid a join.
2023-06-12PSAAS-13720VPE: Playbooks become unresponsive when using an input playbook with "[ ]" in the name
Workaround:
Give the Playbook Action Block in the Automation Playbook a Custom Name that does not contain "[ ]" chars before having a filter reference the output of the Playbook Action Block.