I am getting hung up on using Query Builder on a Resilient script. Basically, I am taking system name artifacts and putting them in a reportable custom field in Resilient. I then extract the values of that custom field and iterate through them to query related incidents based on the hostnames available. The query builder seems to return a result (line 19 in script) but line 21 throws the error attached in the screenshot. The string in question, as stated in the error, is test1.bestbuy.com. I have been working on this for weeks and simply am stuck and have no clue what exactly this error means and how to fix it. From my summation, the syntax of the query seems correct. Thanks for the assistance.

------------------------------
Austin Thomas
------------------------------

Hello, though I'm not the script speciallist, I hope the following  may become a hint.

In your script (line 19), query_builder.hasValue(host).... 

host seems a variable to represent a hostname.

On the other hand  query_builder.hasValue(,,,) should have field name rather than value as argument. For example, fields.incident.addr.

query_builder.hasValue(arg) is the query for returning the incidents whose arg field has some values. (rather than value search)

Just in case you want to search incidents from the hostname value in artifacts,  REST API "/rest/search_ex" might be used. 

Refer to the discussion.   

Search word is annotated with "query" in the filter. 

{
  "query": "<search-value-in-artifacts>",
  "org_id": <org-id>,
  "filters": {
    "incident": [
      {
        "conditions": [
        ]
      }
    ],
    "artifact": [
      {
        "conditions": [
          
        ]
      }
    ]
  },
  "types": [
    "artifact"
  ]
}​

To use REST API in the playbook, "REST API Functions for IBM QRadar SOAR" can be used.