Splunk SOAR (f.k.a. Phantom)

Unable to use foreach or dummy encoding in Phantom Splunk queries?

bowesmana
SplunkTrust
SplunkTrust

Splunk app for Phantom supports running a query on Splunk.
I am trying to use foreach in my query, but the action fails with an error

| foreach x_* [ eval f_{<<FIELD>>}=if(isnotnull('<<FIELD>>'),1,null()) ]

The error I get is

Fri Nov 01 2019 17:15:01 GMT+1100 (Australian Eastern Daylight Time): phantom.format(): Unexpected error in format(): Traceback (most recent call last):
  File "../pylib/phantom/rules.py", line 1119, in format
  File "../pylib/phantom/rules.py", line 188, in encode_all_parameters
  File "../pylib/phantom/rules.py", line 1257, in expand_template_
KeyError: '<<FIELD>>'
Fri Nov 01 2019 17:15:01 GMT+1100 (Australian Eastern Daylight Time): '<<FIELD>>'

Any ideas how to get this through. I tried writing an expanded version of the foreach, i.e.

| eval f_{x_0}=if(isnotnull(x_0), 1, null())...

but that also failed with

Fri Nov 01 2019 17:19:23 GMT+1100 (Australian Eastern Daylight Time): phantom.format(): Unexpected error in format(): Traceback (most recent call last):
  File "../pylib/phantom/rules.py", line 1119, in format
  File "../pylib/phantom/rules.py", line 188, in encode_all_parameters
  File "../pylib/phantom/rules.py", line 1257, in expand_template_
KeyError: 'x_0'
Fri Nov 01 2019 17:19:23 GMT+1100 (Australian Eastern Daylight Time): 'x_0'
Labels (2)
Tags (2)
0 Karma
1 Solution

cblumer_splunk
Splunk Employee
Splunk Employee

Whenever you're using a Format Block within a playbook and the Template contains curly bracket characters "{" or "}" you will need to escape the characters by doubling the brackets "{{" or "}}"

This is due to how the template parameter variables are inserted - {0}, {1}, {2}.. and so on.

This syntax may work better for you:

| foreach x_* [ eval f_{{<<FIELD>>}}=if(isnotnull('<<FIELD>>'),1,null()) ]

or

| foreach x_* [ eval f_{{0}}=if(isnotnull('<<FIELD>>'),1,null()) ]

View solution in original post

ansusabu
Communicator

Have you tried this query in Splunk and made sure that it is working? In 1st query, the problem is "{<>}", If you want to include the braces, then you need to escape the braces using double braces

bowesmana
SplunkTrust
SplunkTrust

Thanks, yes it works in Splunk.

0 Karma

cblumer_splunk
Splunk Employee
Splunk Employee

Whenever you're using a Format Block within a playbook and the Template contains curly bracket characters "{" or "}" you will need to escape the characters by doubling the brackets "{{" or "}}"

This is due to how the template parameter variables are inserted - {0}, {1}, {2}.. and so on.

This syntax may work better for you:

| foreach x_* [ eval f_{{<<FIELD>>}}=if(isnotnull('<<FIELD>>'),1,null()) ]

or

| foreach x_* [ eval f_{{0}}=if(isnotnull('<<FIELD>>'),1,null()) ]

bowesmana
SplunkTrust
SplunkTrust

Thanks - rookie error in Phantom I guess - escaping the braces with double braces worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...