Hi everyone, I'm facing an issue when executing a Splunk search through a Splunk SOAR playbook using the Run Query action. My goal is to pass a JSON array from SOAR to a Splunk search and then parse it with spath. For example, in SOAR I have a variable containing: [{"a":1,"b":2},{"a":3,"b":"text"}] In the search I use something like: | makeresults | eval data="{1}" | spath input=data path={} output=row | mvexpand row | spath input=row However, SOAR appears to escape the double quotes before sending the search to Splunk. Instead of receiving: | eval data="[{\"a\":1,\"b\":2},{\"a\":3,\"b\":\"text\"}]" (or another valid SPL representation) Splunk receives: | eval data=\"[{\"a\":1,\"b\":2},{\"a\":3,\"b\":\"text\"}]\" which causes a parsing error because the escaped quotes are present directly in the SPL query. Additional notes: The source object in SOAR is already a valid JSON string (generated with json.dumps()). The issue occurs before spath is executed. If I hardcode the JSON directly in Splunk, the search works as expected. The problem seems related to how the Run Query action substitutes placeholders ({0}, {1}, etc.) and escapes double quotes. Has anyone encountered this behavior with Splunk SOAR's Run Query action? Is there a recommended way to pass JSON strings containing double quotes into a Splunk search without SOAR escaping them into \"? Thanks in advance. ... View more

Hi guys, I'm searching for a way to disable the outline of the links in splunk classic dashboard. There was a similar question on the community, but i'm not understanding the answers. In my css i'm trying with: a:focus{ outline: none !important} but it doesn't work. Thank you! ... View more

Hi everyone, What's the value of a token if is not set in an input? An empty string, null() or? I was trying to do something like: | eval user=if(isnull("$user_token$"), user, "$user_token$"), but it doesn't work. ... View more

Hi, i'm searching for a way to modify my app/dashboard to be able to modify the entries of a table (such as delete/duplicate/copy/multiselect rows). Any suggestions? Maybe i have to look at the scripts from the lookup editor app? I really don't know where to start. I know how to write in python but i haven't created a script already. Thanks 🙂 Dashboard view ... View more