Splunk Dev

SOAR App Dev: Getting Error - Failed to read message from connector: <app_name>

ankitsync
Explorer

Hi,

I have been developing apps on Splunk SOAR for some time and I have recently encountered App errors that say "Failed to read message from connector: <app_name>" on multiple instances. 

This is mostly observed in cases where I am processing responses from a rest call and filtering data and adding the dictionaries to action results. 

The data structure looks perfect and compared to working actions in the same app I see no difference in action results. 

Also, the Action works fine when tested in App wizard IDE (even for a published app). When tested through a playbook or run manually in a container, I start getting this message again. This is very strange for me as I am stuck on this problem for couple weeks and unable to solve it. I have debugged all data that is mapped to action resulsts results and summary. Also the json file output datapaths are good (have even removed all outputs from json file except default ones to see if they are the issue)

I am facing this issues on two totally different apps on different instances. (Instance 1 running on 5.3.5 and instance 2 on 6.0.

 

Any help is highly appreciated.

An example of proceed response from IDE is pasted below for reference.  I am using this app for interacting with an LLM. As you can see the app runs perfectly fine. I see no data missing or any app errors here.

{"identifier": "text_prompt", "result_data": [{"data": [{"inputTextTokenCount": 4, "results": [{"tokenCount": 50, "outputText": "\nA traffic jam is a situation where a large number of vehicles are moving at a slower speed than usual, often due to an obstruction or congestion in the road. This can cause delays and frustration for drivers, as they struggle to move through the congest", "completionReason": "LENGTH"}]}], "extra_data": [], "summary": {"output_text": "\nA traffic jam is a situation where a large number of vehicles are moving at a slower speed than usual, often due to an obstruction or congestion in the road. This can cause delays and frustration for drivers, as they struggle to move through the congest", "output_tokens": 50, "input_tokens": 4}, "status": "success", "message": "Output text: \nA traffic jam is a situation where a large number of vehicles are moving at a slower speed than usual, often due to an obstruction or congestion in the road. This can cause delays and frustration for drivers, as they struggle to move through the congest, Output tokens: 50, Input tokens: 4", "parameter": {"prompt_text": "explain traffic jam", "model": "amazon.titan-text-lite-v1", "temperature": 0, "top_p": 1, "max_output_token": 50}, "context": {}}], "result_summary": {"total_objects": 1, "total_objects_successful": 1}, "status": "success", "message": "1 action succeeded", "exception_occured": false, "action_cancelled": false}

 

Tags (4)

curtisjester
Explorer

Having a similar issue -- receiving the same error messages with connecting to my third-party service but when trying in the app view screen, testing actions works.. When working from the events/artifacts view I don't get any successful runs.

0 Karma

ankitsync
Explorer

I was finally able to resolve the issue by rewriting the entire Action logic. 

This time my json data that is added to action result data is not a dictionary list inside a list. instead it is a list of dictionary. 

 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...