topic Re: Help with Display Extracted List Items Vertically in Format Block in Splunk SOAR

Help with Display Extracted List Items Vertically in Format Block

Sidpet — Wed, 01 Apr 2026 16:27:46 GMT

Hi all,

I have a playbook where I extract multiple rule titles from an ES investigation. Currently, the data shows like this in the results

Rule Title: 2 items

0: item 1

1: item 2

when I extract it and create a servicenow ticket it shows the items like this ['item 1', 'item 2']. I want them to be displayed like they show in the results vertically one item below the other and without the brackets. I tried the %%

{0}

%% but it does not work. any ideas to help resolve this?

I’m using SOAR version 6.4.x. Any guidance or best practices would be appreciated. still a novice learning the tool.

Thanks!

Re: Help with Display Extracted List Items Vertically in Format Block

phanTom — Wed, 01 Apr 2026 16:44:35 GMT

@Sidpet

The create ticket action on the SNOW app takes in a string. Is the input to the Format Block a list of items or just text/string?

What format block datapath are you inputting into the description field for the SNOW action? Don't use the ".*" one as that will imply to the SNOW action input that it's a list. The one without the ".*" end will just dump a text blob built in the Format Block.

If you need further help if you can share a screenshot of your format block and the input for the SNOW create ticket action we can probably identify where to check next.

-- If this helped please add karma and if it solved it also mark as a solution for future SOAR knowledge hunters! Happy SOARing --