topic Re: Splunk SOAR- Looping over input in Other Usage

Splunk SOAR- Looping over input

harishlnu — Tue, 30 Jul 2024 09:34:41 GMT

Hi @Team,

Could you please help me on looping over inputs in splunk soar.
my requirement:

I am having input like this ,

input=['a','b','c','d']

I need to run query on each value from input like

first it must take 'a' value and run query then from run query result i need to take sys id and pass it to create ticket.

Note: we are using 6.1.1(On-prem)

Please help me on this

Regards,

Harish

Re: Splunk SOAR- Looping over input

marnall — Thu, 01 Aug 2024 18:50:15 GMT

So if I understand correctly, you have a list input with multiple values. For each value in the list, you want SOAR to run a query (in a ticketing system?), then if that query result meets a condition, then you would like SOAR to create a ticket with a sys ID from the result of the query?

Thus if 4 values in the list meet the condition of the query results, then 4 tickets will be created?