Application action datapath 'action_result.data' missing in VPE

[irom77]

I've created app action 'my_action_name' which results I can collect in playbook just fine.

phantom.collect2(container=container, datapath=["my_action_name:action_result.data"], action results=results)

but I don't see action_result.data datapath neither in app documentation nor I can pick it up in VPE . I have only 'status' and 'message' available

[phanTom]

@irom77 have you configured the outputs in the app's json file?

https://docs.splunk.com/Documentation/SOARonprem/6.1.1/DevelopApps/Metadata#Action_Section:_Output 

[irom77]

I set

I set "action_result.data" in the app's json file (short one like below), but it didn't help
and was gone when I tried to edit it again. 

{
      "data_path": "action_result.data",
      "data_type": "string"
   },

Is it something I have to update manually all the time after making any changes?
 

[phanTom]

@irom77 for each field/key you output you need to add to the JSON. 

"action_result.data" is just the array after you get the results from the REST call from the App. 

You need to add "action_result.data.*.<key>" for each value you want to use downstream in a playbook into the JSON for it to be visible as a selectable option. 

You can still use the values in a playbook but you need to add the ".*.<key>" to the end of your datapath in the Playbook. But if you want it to be selectable you need to map it in the JSON outputs section. 

If unsure, you can look at any of the Out of the Box apps JSON files to see how they do it. 

[irom77]

I updated JSON and can see documentation updated as well

summary.data.*.result

string

that key "result" is available per action test

{"identifier": "list_zones", "result_data": [{"data": [{"result":...

But still in VPE I can see only 'status' and 'message' I haven't found anything special in existing apps