How to upload CSV string containing \n to XSOAR?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to upload CSV string containing \n to XSOAR?

L1 Bithead

Hello all,

 

We're writing a custom playbook in Cortex XSOAR that queries Splunk and returns data. The data we receive back from Splunk (via a self-written XSOAR automation, in Python) gets returned as an XML field containing a string that represents a flat CSV file. The \n character sequence (newline) gets added by Splunk to delimit each new line. When prototyping this code via a test incident and using the FileCreateAndUploadV2 command, it errors when the data parameter contains this escape sequence. What is the best way to wrangle the CSV data into an attachment?

 

Screenshot 2024-09-18 at 16.46.55.png

 

Best!

1 accepted solution

Accepted Solutions

L1 Bithead

PEBKAC -- Found that passing in the data= argument to the FileCreateAndUploadV2 command can be arbitrary when used from within an automation. The string we passed to it be formatted in whichever way necessary. Getting a CSV with or without newlines is accepted when done via Python scripting. This works as intended for us now.

View solution in original post

2 REPLIES 2

L1 Bithead

Update: Part of this issue has been resolved by not using the war room to prototype anymore. The command still persists with the invalid escape sequence error when including \n, however this is not true when using shift+enter to manually insert a linebreak into the markdown field.

 

Since this will live in an automation, there's been success with using Python string literals to include linebreaks and submit them to the FileCreateAndUploadV2 command, which is then executed using demisto.executeCommand().

L1 Bithead

PEBKAC -- Found that passing in the data= argument to the FileCreateAndUploadV2 command can be arbitrary when used from within an automation. The string we passed to it be formatted in whichever way necessary. Getting a CSV with or without newlines is accepted when done via Python scripting. This works as intended for us now.

  • 1 accepted solution
  • 495 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!