Applicability
Splunk SOAR Playbook editor
Description
Importing Playbook to SOAR prod from dev is disabling the Editor UI and only the Global Code is displayed.
Moving a playbook from a newer version to an older version will disable the VPE and put it into code editing mode only.
Investigation
Tested moving a playbook made in 6.1 to 5.5 and only saw the code displayed.
Confirmed that changes in the VPE over time are not able to be parsed in older versions which is why it cannot render the VPE UI.
Resolution
Playbooks should be edited on the same or lower version and moved to later versions as needed for use. If development systems are used to make production playbooks, and it is on a later version than production, the playbooks will not show the VPE but can still be used as normal.
Playbook: Export Playbooks
Revision History
| Revision |
Publish Date |
Comments |
1.0 |
29-Sep-2026
|
Initial Release |