topic How do I pass a dictionary into a Format Code Block - error in expanding in Splunk SOAR

How do I pass a dictionary into a Format Code Block - error in expanding

nongingerale — Fri, 21 Apr 2023 17:23:57 GMT

Hello - I'm trying to pass a dictionary into a format code block:

for example:
my_dict = {"hello":"world", "foo":"bar"}

and in the format code block i have:

Contents of dictionary:
{0}

where 0 is mycodeblockname:custom_function:my_dict.hello

and I receive a "error in expanding mycodeblockname:custom_function:my_dict.hello" message. I also tried using :, 0.hello, etc and it hasnt worked. Any suggestions are appreciated. i know that if I pass a dictionary or list from an action block then this works but a custom function doesnt work from what i can see

Re: Format Code Block - error in expanding

phanTom — Thu, 20 Apr 2023 08:12:54 GMT

@nongingerale there are a few possibilities why this might not be working. I tested it and it worked as expected for me so here is how i tested it:

Created a CF with a dict output:

Built a scratch playbook to use the CF:

Then outputted the value to a comment:

Hopefully something in there may help point out the issue.

-- If this solved your issue please mark as a solution for others. Happy SOARing --

Re: Format Code Block - error in expanding

nongingerale — Thu, 20 Apr 2023 12:54:30 GMT

thanks! that worked once i created a custom function (as opposed to passing the dictionary from a custom code block).

Re: Format Code Block - error in expanding

phanTom — Thu, 20 Apr 2023 12:59:30 GMT

@nongingerale yeah the Code Blocks have never been able to have nested JSON understood downstream. Only the new Custom Functions can as it can be a way to get around the limit of 10 outputs.

Thanks for marking as a solution!