Splunk SOAR (f.k.a. Phantom)

add data section to an app results

meshorer
Path Finder

hi,

i built an app, when I run the app's action in a playbook, I dont have an option to get the data results.

I used: action_result.add_data()

but it didnt seem to make a difference,

how can I solve it?

Labels (1)
0 Karma

meshorer
Path Finder

Hi @phanTom 

how can I map the output datapaths in the app's JSON file ? Is there any document link or video that can be assistance for that matter?

0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer I would really need to see the app code to make any informed advice. The tutorial should have the information you need and within the IDE itself you should be able to see the process outputted when testing the action in the IDE. 

Even if the data is being saved, to see it in a playbook as an output datapath you need to map the output datapaths in the app's JSON file. 

I would look at other apps and try to spot any difference in your code when adding results and also the JSON structure for the action outputs. 

Happy SOARing!

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...