- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
02-25-2026 01:36 PM - edited 02-25-2026 02:04 PM
Hi Community!
We're using XSOAR Version 6.0.
Our preprocessing script is not working as expected.
We can't find exactly what causing this but we have a dev XSOAR instance and Prod XSOAR instance, the preprocessing script is working as expected in dev instance and finding the existing incident by the `SearchIncidentsV2` command successfully but it doesn't work in the prod instance. both XSOAR has same version and similar setup and I am sure the ticketnumber exist in production as well. The weird thing is when I manually trigger the
`SearchIncidentsV2` command in playground in production, it did give me back what I am looking for.
Before I am using `SearchIncidentsV2`, I tried `getIncidents` and `getIncidentbyQuery` neither works in either of the instance.
This is dead simple query and I tried hard looking on internet but couldn't find any useful example that can help with identify where is wrong.
Here is the attached preprocessing script.
def main():
incident = demisto.incidents()[0]
ticket_number = incident.get('CustomFields', {}).get('ticketnumber')
if ticket_number:
query = f'ticketnumber:{ticket_number}'
res = demisto.executeCommand('SearchIncidentsV2', {'query': query})
if res and res[0].get('Contents', {}):
return_results(False)
return
return_results(True)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!

