Splunk SOAR

Data access(collect2) bug in phantom v6.1.0

dennyw
Engager

Please help comment on below issue 

Bug description:

Option limit is not processed correctly for phantom.collect2 in phantom version 6.1.0

Reproduce in lab:

testb = phantom.collect2(container=container,tags=["test"], datapath=['artifact:*.name'],limit=0)
phantom.debug(len(testb))

 

There are more than 6000 artifacts in test container

However, phantom.collect2 can only return 1999 results even though we set limit=0 which means no limit

 

Nov 09, 11:19:01 : phantom.collect2(): called for datapath['artifact:*.name'], scope: None and filter_artifacts: None
Nov 09, 11:19:01 : phantom.get_artifacts() called for label: *
Nov 09, 11:19:01 : phantom.collect(): called with datapath: artifact:* / <class 'str'>, limit = 2000, scope=all, filter_artifact_ids=[] and none_if_first=False with trace:False
Nov 09, 11:19:01 : phantom.collect(): calling out to collect_from_container
Nov 09, 11:19:01 : phantom.collect(): called with datapath 'artifact:*', scope='all' and limit=2000. Found 2000 TOTAL artifacts
Nov 09, 11:19:01 : phantom.collect2(): Classified datapaths as [<DatapathClassification.ARTIFACT: 1>]
Nov 09, 11:19:01 : phantom.collect(): called with datapath as LIST of paths, scope='all' and limit=0. Found 1999 TOTAL artifacts
Nov 09, 11:19:01 : 1999

 

 

 
 
 
 
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...