Splunk SOAR

add data section to an app results

meshorer
Path Finder

hi,

i built an app, when I run the app's action in a playbook, I dont have an option to get the data results.

I used: action_result.add_data()

but it didnt seem to make a difference,

how can I solve it?

Labels (1)
0 Karma

meshorer
Path Finder

Hi @phanTom 

how can I map the output datapaths in the app's JSON file ? Is there any document link or video that can be assistance for that matter?

0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer I would really need to see the app code to make any informed advice. The tutorial should have the information you need and within the IDE itself you should be able to see the process outputted when testing the action in the IDE. 

Even if the data is being saved, to see it in a playbook as an output datapath you need to map the output datapaths in the app's JSON file. 

I would look at other apps and try to spot any difference in your code when adding results and also the JSON structure for the action outputs. 

Happy SOARing!

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...