SOAR101 question regarding passing variables

[NuttyBrown]

Just getting started with SOAR and I am encountering a scenario where I obviously don't understand the concept enough. I could use a push in the right direction to understand how I'm supposed to pass output from a Splunk action block to a decision or utility block. Logic is as follows:

1. We utilize a Splunk -- Timer asset to schedule execution of playbook at certain time

2. First block is a Splunk query action block; basic SPL is 

index=custom_index usernames=* | table usernames, emailAddresses, userScore

3. I want to pass the usernames to a decision block, and this is where I get lost. I see event choices, and CEF fields, etc. as options, but nothing explicitly stated for "usernames". Am I supposed to custom code a solution using action_result.data, and if so, can I get a hint on how to do so? (this wasn't covered in my creating playbooks course)

Thank you

[livehybrid · Accepted solution]

Hi

To pass the usernames field from your Splunk action block to a decision or utility block in SOAR, use the custom output paths from the action result.

In the decision block, reference the field as action_result.data.*.usernames.

The Splunk action block returns results as a list of dictionaries under action_result.data.

The .*. wildcard iterates over each result, accessing the usernames field from each row.

Field names are case-sensitive and must match exactly as returned by your SPL.

If your SPL returns multiple rows, the path will return a list of values.

The following docs pages may also be useful:

https://docs.splunk.com/Documentation/SOAR/current/Playbook/SpecifyData

https://docs.splunk.com/Documentation/SOAR/current/DevelopApps/DataPath

https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/Datapaths

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing