SOAR - playbook is not running when new Splunk events are being added

Applicability

Description

When using Sent to SOAR action, it also uses Grouping which collect artifacts into one container. 

In Splunk App for SOAR Export page, under Configurations, expand Advanced, it uses Split multivalue fields into multiple artifacts before sending (default) 

Investigation

When multi-value fields contain duplicate values, the Splunk App for SOAR Export App sends duplicate artifacts with different run_automation flags (from version 4.3.25 and later, the App only sets the last event from the saved search with run_automation flag as True to trigger playbook run only once for all ingested events).  SOAR's deduplication logic doesn't account for this flag difference, causing the artifact with run_automation=True to be rejected as a duplicate. This prevents automation from running.

For example, there is one result from the saved search, the run_automation flag as false when processing multivalue field 1, and run_automation flag as true when processing multivalue field 2:

2026-02-15 15:12:46,170 log_level=INFO pid=95748 tid=MainThread file=cim_actions.py:message:436 | sendmodaction - worker="worker1" signature="Processing multivalue fields 1 of 2 for result 1 of 1. Running automation: False" action_name="sendtophantom" search_name="search1" ... digest_mode="1" action_mode="saved" action_status="success"
2026-02-15 15:12:46,349 log_level=INFO pid=95748 tid=MainThread file=cim_actions.py:message:436 | sendmodaction - worker="worker1" signature="Processing multivalue fields 2 of 2 for result 1 of 1. Running automation: True" action_name="sendtophantom" search_name="search1"...

In SOAR wsgi log, the second POST failed and got 400 error which is the one with run_automation flag as true. 

[pid: 475219|app: 0|req: 319201/2934686] 172.24.237.202 () {48 vars in 707 bytes} [Sun Feb 15 20:12:46 2026] POST /rest/container => generated 55 bytes in 66 msecs (HTTP/1.1 200) 4 headers in 116 bytes (1 switches on core 0)
[pid: 315891|app: 0|req: 194923/2934687] 172.24.237.202 () {48 vars in 707 bytes} [Sun Feb 15 20:12:46 2026] POST /rest/artifact => generated 33 bytes in 144 msecs (HTTP/1.1 200) 4 headers in 116 bytes (1 switches on core 0)
[pid:198245] [15/Feb/2026 20:12:46] log.py:246 WARNING: Bad Request: /rest/artifact
[pid: 198245|app: 0|req: 361648/2934690] 172.24.237.202 () {48 vars in 707 bytes} [Sun Feb 15 20:12:46 2026] POST /rest/artifact => generated 88 bytes in 163 msecs (HTTP/1.1 400) 4 headers in 125 bytes (1 switches on core 0)

The playbook automation never ran. 

Resolution

This is known issue and fixed in Splunk App for SOAR Export 4.4.1. Please download the version from Splunk App for SOAR Export | Splunkbase 

If upgrade is not an option, a recommend workaround is to ensure multi-valued fields contain only unique values before sending data to SOAR.

For example, using the mvdedup command in SPL on fields like userPrincipalName can help:

| eval userPrincipalName=mvdedup(userPrincipalName) | eval <other_multivalue_field>=mvdedup(<other_multivalue_field>)