result from value field in playbook is none

[ASEP]

hai, i have a problem with field in playbook 

I’m building a SOAR playbook to check network traffic to Active Directory Web Services, and I’m stuck on one field

My Objective:

Use a Run Query action in SOAR to pull additional_action, If additional_action contains “teardown,” route the playbook down a specific branch.

 tstats summariesonly=true fillnull_value="unknown" 
  values(All_Traffic.src) as src
  values(All_Traffic.dest) as dest  
  values(All_Traffic.additional_action) as additional_action
  values(All_Traffic.status_action) as status_action
  values(All_Traffic.app) as app
  count 
  from datamodel="Network_Traffic"."All_Traffic" 
  WHERE (All_Traffic.src_ip IN ({0})) 
    AND (All_Traffic.dest_ip IN ({1})) 
    AND (All_Traffic.dest_port="{2}") 
  by All_Traffic.session_id
| nomv additional_action

if I use the query there is a teardown result

i have added field additional_action 

but the result from playbook is Parameter: {"comment":"Protocol value None , mohon untuk dilakukan analisa kembali.  

is there any way to solve this problem 

[livehybrid]

Hi @ASEP 

The field value from a "Run Query" action in a Splunk SOAR playbook needs to be accessed from the list of results returned by the action. Simply adding the field name under "Fields to add to output" makes the field available, but you still need to reference the correct result object.

The Run Query action typically returns a list of results in the results.data attribute of the action's output. You need to access the specific result you are interested in (e.g., the first one) and then the field within that result.

Assuming your "Run Query" action is named your_action_name, you can access the additional_action field from the first result using templating like this:

{{ your_action_name.results.data[0].additional_action }}

You can then use this value in subsequent playbook logic, such as a decision block to check if it contains "teardown".

The Run Query action returns a list of result objects in action_name.results.data. Each object in this list corresponds to a row returned by your Splunk query. You access elements in the list using square brackets [index] and fields within an object using dot notation .field_name.

Check if the results.data list is not empty before attempting to access elements by index (like [0]) to prevent errors or None values if the query returns no results. I think you should be able to use {% if your_action_name.results.data %} block for this.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing