SOAR - How to remove obsolete playbooks that fail to be deleted from Web UI

Available Languages

Updated:September 29, 2026
Document ID:SPLK046635

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk SOAR

Description

SOAR stores all playbook in playbook table in PostgreSQL database. If for any reason the playbook become obsolete and it cannot be deleted from the web portal, the problematic playbook can be manually disabled from playbook table via update statement against PostgreSql DB directly as a workaround.


Investigation

Steps to reproduce the issue:

  1. On SOAR Web UI, navigate to “Playbooks“ page

  2. Select the playbook that needs to be deleted

  3. After click "Delete" and then "Confirm", it shows the error message as below:

Delete PlaybooksDeleted 0 playbook.
Failed to delete My-Demo-Playbook-to-delete (id: 28157)"

     

 


Resolution

Steps to disable the problematic playbook from DB table manually:

  • Log into your SOAR command line as phantom user and run below command to enter PostgreSQL shell:
#phenv python /opt/phantom/www/manager.py dbshell
  •    Query the problematic playbook by the SQL command and confirm the name of playbook is one that needs to be deleted
phantom=> SELECT id, name, version, disabled,python_version FROM playbook where id=28157;  id   |                     name                     | version | disabled | python_version-------+----------------------------------------------+---------+----------+----------------28157 | My-Demo-Playbook-to-delete                    |      15 | f        | 3(1 row)
  • Disable the playbook via update statement as below SQL command (example is to delete the playbook id=28157):
phantom=> UPDATE playbook SET disabled=True WHERE id = 28157;UPDATE 1phantom=> SELECT id, name, version, disabled,python_version FROM playbook where id=28157;  id   |                     name                     | version | disabled | python_version-------+----------------------------------------------+---------+----------+----------------28157 | My-Demo-Playbook-to-delete                    |      15 | t        | 3(1 row)
  • Validate from SOAR Web UI and confirm the problematic playbook is not shown in the playbooks list anymore.
 
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco