When an array of dictionaries is assigned to the output variable of a code block, only the whole array can be used as input on the following blocks, but using a data path selector for key selection throws an error.
Value of the output variable:
[
{
"tags": [
"tag1"
],
"domain": "example1.com"
},
{
"tags": [
"tag2"
],
"domain": "example2.com"
}
]
Data Paths:
Working:
function_name:custom_function:result_domains
Not Working:
function_name:custom_function:result_domains.*.domain
The not working selection throws the following error:
Python Error: Traceback (most recent call last):
File "../pylib/phantom/decided/internals.py", line 445, in call_playbook_action_callback
File "../pylib/phantom/decided/internals.py", line 159, in invoke_callback_for_callable
File "../pylib/phantom/decided/internals.py", line 268, in _invoke_callback_for_callable
File "<playbook>", line 93, in get_url_calltrace_callback
File "<playbook>", line 399, in domains
File "<playbook>", line 499, in code_11
File "/opt/phantom/usr/python36/lib/python3.6/json/__init__.py", line 354, in loads
return _default_decoder.decode(s)
File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 339, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 357, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
Is this a known limitation of the code block (not custom function) in Splunk SOAR?
