Splunk SOAR

add data section to an app results

meshorer
Path Finder

hi,

i built an app, when I run the app's action in a playbook, I dont have an option to get the data results.

I used: action_result.add_data()

but it didnt seem to make a difference,

how can I solve it?

Labels (1)
0 Karma

meshorer
Path Finder

Hi @phanTom_old 

how can I map the output datapaths in the app's JSON file ? Is there any document link or video that can be assistance for that matter?

0 Karma

phanTom_old
SplunkTrust
SplunkTrust

@meshorer I would really need to see the app code to make any informed advice. The tutorial should have the information you need and within the IDE itself you should be able to see the process outputted when testing the action in the IDE. 

Even if the data is being saved, to see it in a playbook as an output datapath you need to map the output datapaths in the app's JSON file. 

I would look at other apps and try to spot any difference in your code when adding results and also the JSON structure for the action outputs. 

Happy SOARing!

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...