String Function Action Json

[Daniel_Acevedo]

Currently I am trying to test a playbook that takes in a hash as input, but I have multiple hashes coming in that are comma separated. I'm trying to use the split function within the string functions action, but when I try to go into my next action and select the first string from the split output, the string function json output is completely empty. In other words, when I run the playbook I can see that the split function is pulling all the hashes out and separating them, but when trying to select one of these hashes as input for a later action, the json is completely empty in the "Insert Placeholder" window. 

[f3rz]

Hi, @Daniel_Acevedo , it is hard to tell what is wrong here. Could you please provide some samples that can be used for testing or some screenshots with JSON and how it is split for better understanding? 

[Daniel_Acevedo]

- technical details for 2 string values hash 1 and hash 2 getting split.

- INsert placeholder field being blank when trying to select the json output as an input for a block that comes after the split action.

[AymanC]

Hi @Daniel_Acevedo,

The 'Insert Placeholder' will show a sample below in that box, of which you don't have any sample. To modify this, the following reference should help - https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/working-with-playbook-si...

Kind Regards,

Ayman

[vanitharaj1208]

export the json result of the action

and go to IDE and under the respective integration and select the action , you will find a option to import json at the top right corner.

[SoarAndy]

As others have said
Your last image is the placeholder picker, this does not render REAL or LIVE data, it is sample data retrieved from the IDE. If the Action has sample data stored, then it is shown here.

For many actions (enrich user) the output structure is known/repeatable/predictable, but for some actions (tools, split, buffer) the output is completely unpredicable as it depends on what the user is doing.  Therefore we do not / cannot include sample data. 

I encourage you to log a Feature Request through support for 'Insert Placeholder' window to first consider Simulated data, and if not present then fall back to IDE sampel data.  This would be a lovely feature and the more people request it the more attention it gets with the PM team.

Andy