Splunk IT Service Intelligence Certified Admin — Question 33

Which of the following queries would return all failed playbook runs from the REST API?

Answer options

• A. https://<PHANTOM_URL>/rest/playbook_run?_filter_status failed
• B. https://<PHANTOM_URL>/rest/playbook_run?_filter_status "failed"
• C. https://<PHANTOM_URL>/rest/playbook_run?_search_status=failed
• D. https://<PHANTOM_URL>/rest/playbook_run?_query_status="failed"

Correct answer: D

Explanation

Option D is correct as it uses the appropriate query parameter format to filter for playbook runs with a status of 'failed'. The other options either use incorrect syntax or parameter names that do not align with the REST API requirements, making them invalid for this query.