When Output array of dictionaries from code block, receiving this error

Benni — Tue, 22 Mar 2022 09:05:41 GMT

When an array of dictionaries is assigned to the output variable of a code block, only the whole array can be used as input on the following blocks, but using a data path selector for key selection throws an error.

Value of the output variable:

[ { "tags": [ "tag1" ], "domain": "example1.com" }, { "tags": [ "tag2" ], "domain": "example2.com" } ]

Data Paths:

Working: function_name:custom_function:result_domains Not Working: function_name:custom_function:result_domains.*.domain

The not working selection throws the following error:

Python Error: Traceback (most recent call last): File "../pylib/phantom/decided/internals.py", line 445, in call_playbook_action_callback File "../pylib/phantom/decided/internals.py", line 159, in invoke_callback_for_callable File "../pylib/phantom/decided/internals.py", line 268, in _invoke_callback_for_callable File "<playbook>", line 93, in get_url_calltrace_callback File "<playbook>", line 399, in domains File "<playbook>", line 499, in code_11 File "/opt/phantom/usr/python36/lib/python3.6/json/__init__.py", line 354, in loads return _default_decoder.decode(s) File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 339, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 357, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Is this a known limitation of the code block (not custom function) in Splunk SOAR?

topic When Output array of dictionaries from code block, receiving this error in Splunk SOAR

When Output array of dictionaries from code block, receiving this error