topic Re: Application action datapath 'action_result.data' missing in VPE in Splunk SOAR

Application action datapath 'action_result.data' missing in VPE

irom77 — Sat, 16 Sep 2023 18:11:33 GMT

I've created app action 'my_action_name' which results I can collect in playbook just fine.

phantom.collect2(container=container, datapath=["my_action_name:action_result.data"], action results=results)

but I don't see action_result.data datapath neither in app documentation nor I can pick it up in VPE . I have only 'status' and 'message' available

Re: Application action datapath 'action_result.data' missing in VPE

phanTom — Mon, 18 Sep 2023 08:22:13 GMT

@irom77 have you configured the outputs in the app's json file?

https://docs.splunk.com/Documentation/SOARonprem/6.1.1/DevelopApps/Metadata#Action_Section:_Output

Re: Application action datapath 'action_result.data' missing in VPE

irom77 — Mon, 18 Sep 2023 13:49:13 GMT

I set

I set "action_result.data" in the app's json file (short one like below), but it didn't help
and was gone when I tried to edit it again. 

{
      "data_path": "action_result.data",
      "data_type": "string"
   },

Is it something I have to update manually all the time after making any changes?

Re: Application action datapath 'action_result.data' missing in VPE

phanTom — Mon, 18 Sep 2023 14:45:22 GMT

@irom77 for each field/key you output you need to add to the JSON.

"action_result.data" is just the array after you get the results from the REST call from the App.

You need to add "action_result.data.*.<key>" for each value you want to use downstream in a playbook into the JSON for it to be visible as a selectable option.

You can still use the values in a playbook but you need to add the ".*.<key>" to the end of your datapath in the Playbook. But if you want it to be selectable you need to map it in the JSON outputs section.

If unsure, you can look at any of the Out of the Box apps JSON files to see how they do it.

Re: Application action datapath 'action_result.data' missing in VPE

irom77 — Mon, 18 Sep 2023 16:24:05 GMT

I updated JSON and can see documentation updated as well

summary.data.*.result

string

that key "result" is available per action test

{"identifier": "list_zones", "result_data": [{"data": [{"result":...

But still in VPE I can see only 'status' and 'message' I haven't found anything special in existing apps