Troubleshoot Closing Case Incident after Changing Field Type

Resolve incident closing issues after changing a field type in Cortex XSOAR 6.13.

After deleting a field of type Grid (table) and creating/installing a new field of another type (string, long text, etc.), the following error occurs when trying to close or update an incident:

Cannot convert type []interface {} of '[map[] map[]]' to type string, field: sourceip (8902)

This error occurs if you create a field of type table/grid and associate it with an incident type. You then create an incident with that field. Now you delete that table/grid field and create/install a new field with the same name but associate it with a different type (such as short text). When you try to close the incident that has that field, the error occurs. This error can occur with other field type changes if the fields are not of compatible types such as changing the type from long text to boolean or URL to short text.

To resolve this issue, perform the steps in the following procedure.

1. Go to Settings → OBJECTS SETUP → Incidents → Types .
2. Select the incident type that contains the changed field.
3. Click Edit Layouts.
4. Click “Close” Form if you want to close the incident or “New”/”Edit” Form if you want to edit the incident.
5. Add the field you changed to the form.
6. Save the form.
7. Go to the Incidents page and click the incident.
8. Click Actions → Close Incident if you want to close the incident or Edit if you want to edit the incident.
9. In the Custom Field area, reset (delete) the value for the field you changed.

   

   incident-troubleshoot-change-field-type.png
10. Click Close Incident or Update Incident.