Splunk Update Notable Events action error

Question

Hi All,When im executing the action Update Notable Events it is throwing error Action wasn't able to update notable events. Reason:ValueError: Invalid disposition 'disposition:None'. Configured dispositions are 'disposition:0,disposition:1,disposition:2,disposition:3,disposition:4,disposition:5,disposition:6'My requirement is whenever a case is assigned to user , the same should reflect in Splunk like status should be Inprogress state and user will be placeholder [Case.Assigned user]. Attached error screenshot. How to fix this one

Ulab · Answer

The error happens because Splunk SOAR only accepts specific disposition values (0–6). disposition:None is invalid. To fix this, ensure your action maps the case status to one of the valid dispositions. For “In Progress,” use the corresponding numeric value (e.g., disposition:2) and dynamically set the assigned user via [Case.Assigned User]. This should allow the notable event to update correctly.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded