Splunk SOAR

When Output array of dictionaries from code block, receiving this error

Benni
Loves-to-Learn

When an array of dictionaries is assigned to the output variable of a code block, only the whole array can be used as input on the following blocks, but using a data path selector for key selection throws an error.

Value of the output variable:

 

[
    {
        "tags": [
            "tag1"
        ],
        "domain": "example1.com"
    },
    {
        "tags": [
            "tag2"
        ],
        "domain": "example2.com"
    }
]

 

Data Paths:

 

Working:
function_name:custom_function:result_domains

Not Working:
function_name:custom_function:result_domains.*.domain

 

The not working selection throws the following error:

 

Python Error: Traceback (most recent call last):
  File "../pylib/phantom/decided/internals.py", line 445, in call_playbook_action_callback
  File "../pylib/phantom/decided/internals.py", line 159, in invoke_callback_for_callable
  File "../pylib/phantom/decided/internals.py", line 268, in _invoke_callback_for_callable
  File "<playbook>", line 93, in get_url_calltrace_callback
  File "<playbook>", line 399, in domains
  File "<playbook>", line 499, in code_11
  File "/opt/phantom/usr/python36/lib/python3.6/json/__init__.py", line 354, in loads
    return _default_decoder.decode(s)
  File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 339, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/opt/phantom/usr/python36/lib/python3.6/json/decoder.py", line 357, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

 

Is this a known limitation of the code block (not custom function) in Splunk SOAR?

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...