Hi everyone, I'm facing an issue when executing a Splunk search through a Splunk SOAR playbook using the Run Query action. My goal is to pass a JSON array from SOAR to a Splunk search and then parse it with spath. For example, in SOAR I have a variable containing: [{"a":1,"b":2},{"a":3,"b":"text"}] In the search I use something like: | makeresults
| eval data="{1}"
| spath input=data path={} output=row
| mvexpand row
| spath input=row However, SOAR appears to escape the double quotes before sending the search to Splunk. Instead of receiving: | eval data="[{\"a\":1,\"b\":2},{\"a\":3,\"b\":\"text\"}]" (or another valid SPL representation) Splunk receives: | eval data=\"[{\"a\":1,\"b\":2},{\"a\":3,\"b\":\"text\"}]\" which causes a parsing error because the escaped quotes are present directly in the SPL query. Additional notes: The source object in SOAR is already a valid JSON string (generated with json.dumps()). The issue occurs before spath is executed. If I hardcode the JSON directly in Splunk, the search works as expected. The problem seems related to how the Run Query action substitutes placeholders ({0}, {1}, etc.) and escapes double quotes. Has anyone encountered this behavior with Splunk SOAR's Run Query action? Is there a recommended way to pass JSON strings containing double quotes into a Splunk search without SOAR escaping them into \"? Thanks in advance.
... View more