Splunk Dev

SOAR App Dev: Getting Error - Failed to read message from connector: <app_name>

ankitsync
Explorer

Hi,

I have been developing apps on Splunk SOAR for some time and I have recently encountered App errors that say "Failed to read message from connector: <app_name>" on multiple instances. 

This is mostly observed in cases where I am processing responses from a rest call and filtering data and adding the dictionaries to action results. 

The data structure looks perfect and compared to working actions in the same app I see no difference in action results. 

Also, the Action works fine when tested in App wizard IDE (even for a published app). When tested through a playbook or run manually in a container, I start getting this message again. This is very strange for me as I am stuck on this problem for couple weeks and unable to solve it. I have debugged all data that is mapped to action resulsts results and summary. Also the json file output datapaths are good (have even removed all outputs from json file except default ones to see if they are the issue)

I am facing this issues on two totally different apps on different instances. (Instance 1 running on 5.3.5 and instance 2 on 6.0.

 

Any help is highly appreciated.

An example of proceed response from IDE is pasted below for reference.  I am using this app for interacting with an LLM. As you can see the app runs perfectly fine. I see no data missing or any app errors here.

{"identifier": "text_prompt", "result_data": [{"data": [{"inputTextTokenCount": 4, "results": [{"tokenCount": 50, "outputText": "\nA traffic jam is a situation where a large number of vehicles are moving at a slower speed than usual, often due to an obstruction or congestion in the road. This can cause delays and frustration for drivers, as they struggle to move through the congest", "completionReason": "LENGTH"}]}], "extra_data": [], "summary": {"output_text": "\nA traffic jam is a situation where a large number of vehicles are moving at a slower speed than usual, often due to an obstruction or congestion in the road. This can cause delays and frustration for drivers, as they struggle to move through the congest", "output_tokens": 50, "input_tokens": 4}, "status": "success", "message": "Output text: \nA traffic jam is a situation where a large number of vehicles are moving at a slower speed than usual, often due to an obstruction or congestion in the road. This can cause delays and frustration for drivers, as they struggle to move through the congest, Output tokens: 50, Input tokens: 4", "parameter": {"prompt_text": "explain traffic jam", "model": "amazon.titan-text-lite-v1", "temperature": 0, "top_p": 1, "max_output_token": 50}, "context": {}}], "result_summary": {"total_objects": 1, "total_objects_successful": 1}, "status": "success", "message": "1 action succeeded", "exception_occured": false, "action_cancelled": false}

 

Tags (4)

curtisjester
Explorer

Having a similar issue -- receiving the same error messages with connecting to my third-party service but when trying in the app view screen, testing actions works.. When working from the events/artifacts view I don't get any successful runs.

0 Karma

ankitsync
Explorer

I was finally able to resolve the issue by rewriting the entire Action logic. 

This time my json data that is added to action result data is not a dictionary list inside a list. instead it is a list of dictionary. 

 

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...