closing duplicated tickets in XSOAR & Splunk automatically

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

closing duplicated tickets in XSOAR & Splunk automatically

L0 Member



i am trying to close duplicated tickets on XSOAR and Splunk automatically using pre processing rules (for closing on XSOAR) and post processing rule (for closing on Splunk) which i wrote a script for

However i cannot test the post processing scripts because the pre processing script closes the tickets and i cannot reopen them or access the ticket to run the script to test it before applying the post process rule.


close_reason = str(demisto.args().get('closeReason'))
closing_user = str(demisto.args().get('closingUserId'))
if close_reason == "Duplicate" and closing_user == 'DBot':
EVID = str(demisto.incident()['CustomFields']['splunkeventid'])
user_auto = demisto.executeCommand("setIncident", {'owner' : 'admin'})
demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EVID ,'owner': user_auto, "comment": "Auto closing this Duplicate Alarm" ,"status":"5" })

EID = str(demisto.incident()['CustomFields']['splunkeventid'])
nota = str(demisto.incident()['CustomFields']['closernote'])
user = str(demisto.incident()['owner'])
demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EID,'owner': user, "comment": nota ,"status":"5" })

print("you are trying to close a manual ticket")


L4 Transporter

Hi @abdulazizh,


If your script works as expected, post-processing should work as well. You cannot run any command on the closed incidents. If you want to test before implementing it, I would recommend having another pre-process rule for fake alerts and doing the testing on those ones by triggering some fake alerts on Splunk. I could not reproduce the issue due to the lack of Splunk integration, but Slack notification with incident details worked. So, you need to make sure the below command works as expected.


demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EID,'owner': user, "comment": nota ,"status":"5" })


  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!