Splunk SOAR (f.k.a. Phantom)

add data section to an app results

meshorer
Path Finder

hi,

i built an app, when I run the app's action in a playbook, I dont have an option to get the data results.

I used: action_result.add_data()

but it didnt seem to make a difference,

how can I solve it?

Labels (1)
0 Karma

meshorer
Path Finder

Hi @phanTom 

how can I map the output datapaths in the app's JSON file ? Is there any document link or video that can be assistance for that matter?

0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer I would really need to see the app code to make any informed advice. The tutorial should have the information you need and within the IDE itself you should be able to see the process outputted when testing the action in the IDE. 

Even if the data is being saved, to see it in a playbook as an output datapath you need to map the output datapaths in the app's JSON file. 

I would look at other apps and try to spot any difference in your code when adding results and also the JSON structure for the action outputs. 

Happy SOARing!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...