The only resolution for environments experiencing this bottleneck was to move to a cluster model (or add new nodes if they were already in a cluster). Previously, Splunk Phantom was able to kick off one action at a time, creating an artificial bottleneck that wasn’t directly related to system resource utilization. By configuring multiple playbook runners, a single Splunk Phantom instance can now handle, run and execute multiple actions from different playbooks simultaneously. (We call it “vertical scaling.”) It helps you to scale automation at your organization. We now allow you to configure the number of playbook runners, using Python 2 and Python 3.

With the release of Splunk Phantom 4.10.1, that’s exactly what we did. If we can support two playbook runners, then why not more!? This may all sound like a bunch of technical jargon, but this process yielded one key epiphany: In doing so, we needed to create two different “playbook runners” to ensure we could continue to support playbooks written in Python 2.7 while also supporting Python 3. In fact, Python 3 is now the default for Splunk Phantom playbooks. Splunk Phantom 4.10 introduced many new enhancements, including the ability to develop playbooks in Python 3.

Splunk phantom python