topic Can I extend the limits of output in my playbook? in Splunk SOAR

Can I extend the limits of output in my playbook?

peterng_ — Tue, 04 Oct 2022 13:35:27 GMT

I'm using Splunk SOAR 5.3.3. When I add 10 outputs for a playbook, the warning text appear "Limit 10 outputs reached".

Can I extend the limits of output in my playbook?

Re: Can I extend the limits of output in my playbook?

fkpp2 — Wed, 11 Jan 2023 10:04:25 GMT

probably a little bit late and you might have found a solution to this already.

What I am doing in case I need more than 10 input or output variables, is putting a JSON object into one of the variables and parse it in the parent/sub playbook accordingly.

BR,

Florian

Re: Can I extend the limits of output in my playbook?

phanTom — Wed, 11 Jan 2023 11:28:57 GMT

@fkpp2 @peterng_ you can actually get them by using "nested JSON" in the output and can also use the datapath in the playbook without parsing.

E.G.

output of CF = <field>

Output JSON {"field": {"sub-field1": "<value>", "sub-field2", "<value>"}}

Then just add the sub-field name to the datapath in the playbook:

-- If this helps please mark as a solution. Happy SOARing! --

Re: Can I extend the limits of output in my playbook?

fkpp2 — Wed, 11 Jan 2023 11:46:30 GMT

When a CF comes into play, I agree with your approach.

Otherwise this is what I was suggesting, when trying to pass more than 10 variables to a sub playbook:

Main PB:

Sub PB:

You just need to json.loads() the ticket_input data according to your needs in a CF / code block and can access the fields as a datapath.

BR,

Florian

Re: Can I extend the limits of output in my playbook?

phanTom — Wed, 11 Jan 2023 11:54:59 GMT

@fkpp2 ah yes, apologies I saw 10 outputs and instantly went to CF 😄

I like your approach for the playbooks. Thanks for clarifying as I am sure it will help ppl in the future.