Splunk SOAR

Python Validation failed for SOAR App Install -- "main_module"

curtisjester
Explorer

Context: Custom app development and iteration. I have created an app with the App Wizard and I am editing it locally. When it comes time to tarball it and upload it; the validation fails on "main_module" even though the JSON file was generated by SOAR

Hi there, I am not necessarily new to app development in SOAR. I have created a connector before and I am iterating and creating V2. Unfortunately, this time around I cannot understand the issue I am receiving when I try to install my updated app. 

My general development cycle looks like this: 

init: Create the App via the Wizard. 

1. Download the App and make changes; fill it out and now tarball it.

2. Upload the app and test; tweak via the web gui if needed; otherwise delete the app, update local code, re-tarball it and upload again... repeat. 

(Please don't suggest the VSCode integration; I have used it in the past and am aware it exists)

 

Now to the problem

I have coded my changes and am ready to upload the first iteration. I delete the app (the skeleton code from the App Wizard creation) and then install it. I get this error: [img text: 'teamdynamix.json' failed validation on value 'main_module']

curtisjester_0-1771431740453.png

(Within the JSON we have this line:  "main_module": "teamdynamix_connector.py", )

My File in the subfolder "phTeamDynamix": teamdynamix_connector.py.

So... I downloaded the version 1 I know works. I added a single line to the Consts file that's included. I tarball and upload, and I get the error above. I'm curious why this is producing issues.  The only file changed is a file SOAR doesn't have a problem with; but the file that SOAR has a problem with was auto-generated. 

 

My guess is this is related to the file structure or pre-pending of "ph" to the file structure when downloading the project or something like that.  Anyone encounter issues like this before? Any recommendations on how to structure my tarball before uploading? Should I rename the dir to remove the pre-pended "ph" to the structure? At a loss... Thanks!

0 Karma
1 Solution

curtisjester
Explorer

Self-Solution: DO NOT EDIT THEN UPLOAD

 

Long Story Short: Edit within the IDE after cloning, and then you can publish a V2 of your app. 

Use the VS Code extension and learn the proper way to edit the source code and then 'repackage and deploy' to the cloud using the run actions for the extension. This way SOAR appropriate tracks files and version numbers, and is expecting every change you provide it. 

View solution in original post

0 Karma

curtisjester
Explorer

Self-Solution: DO NOT EDIT THEN UPLOAD

 

Long Story Short: Edit within the IDE after cloning, and then you can publish a V2 of your app. 

Use the VS Code extension and learn the proper way to edit the source code and then 'repackage and deploy' to the cloud using the run actions for the extension. This way SOAR appropriate tracks files and version numbers, and is expecting every change you provide it. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...