Splunk SOAR

When Output array of dictionaries from code block, receiving this error

Benni
Loves-to-Learn

When an array of dictionaries is assigned to the output variable of a code block, only the whole array can be used as input on the following blocks, but using a data path selector for key selection throws an error.

Value of the output variable:

 

[
    {
        "tags": [
            "tag1"
        ],
        "domain": "example1.com"
    },
    {
        "tags": [
            "tag2"
        ],
        "domain": "example2.com"
    }
]

 

Data Paths:

 

Working:
function_name:custom_function:result_domains

Not Working:
function_name:custom_function:result_domains.*.domain

 

The not working selection throws the following error:

 

Python Error: Traceback (most recent call last):
  File "../pylib/phantom/decided/internals.py", line 445, in call_playbook_action_callback
  File "../pylib/phantom/decided/internals.py", line 159, in invoke_callback_for_callable
  File "../pylib/phantom/decided/internals.py", line 268, in _invoke_callback_for_callable
  File "<playbook>", line 93, in get_url_calltrace_callback
  File "<playbook>", line 399, in domains
  File "<playbook>", line 499, in code_11
  File "/opt/phantom/usr/python36/lib/python3.6/json/__init__.py", line 354, in loads
    return _default_decoder.decode(s)
  File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 339, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 357, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

 

Is this a known limitation of the code block (not custom function) in Splunk SOAR?

Labels (2)
Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...