Creating and Using Workflow Actions

Question 1

What are workflow actions?

Answer 1

Workflow actions let us create links within events that interact with external resources or narrow down our search.

Question 2

How do workflow actions pass information to external resources?

Answer 2

Workflow actions use HTTP GET or POST methods.

Information can also be passed back to Splunk for a secondary search.

Question 3

What fields are required when creating a workflow action?

Answer 3

Name, Label, Action Type (link or search) and URI

Question 4

Which workflow action method can be used when the action type is set to link?

Answer 4

GET and POST can both use Link.

Question 5

How do you create a GET workflow action?

Answer 5

1. Select the app
2. Name the workflow action with no spaces or special characters
3. Define the label, which will appear in the Event Action menu
4. Determine if your workflow action applies to a field or event type
5. From the Show action in dropdown list, select Event menu
6. From Action type dropdown list, select link
7. Enter the URI of where the user will be directed
8. Specify if the link should open in a New window or Current window
9. Select the Link method of get
10. Save

Question 6

Where can you navigate to create a Workflow Action?

Answer 6

Settings > Fields > Workflow Actions > New Workflow Action

Question 7

When creating a Search workflow action, which field is required?

Answer 7

Search string

Question 8

Which workflow uses field values to perform a secondary search?

Answer 8

Search

Question 9

What is the difference between GET, POST, and Search?

Answer 9

GET - Retrieve information from an external resource

POST - Send field values to an external source

Search - Use field values to perform a secondary search

Question 10

What is a limitation of searches generated by workflow actions?

Answer 10

Searches generated by workflow actions run with the same permissions as the user running them.

Your role and permissions determine your ability to modify an object’s settings.

Question 11

How do you create a Search workflow action?

Answer 11

1. Select the app
2. Name the workflow action with no spaces or special characters
3. Define the label, which will appear in the Event Action menu
4. Determine if your workflow action applies to a field or event type
5. From the Show action in the dropdown list, select Event menu
6. From the Action type dropdown list, select search
7. Enter the Search string
8. Select the app if it is different from the current app
9. Enter the view name where the search will execute
10. Indicate if the search should run in a New window or the Current window
11. Enter the time range for the search or choose to use the same time range as the search
12. Save

Question 12

What can a POST workflow action be used for?

Answer 12

POST workflow actions generate an HTTP POST request to a specified URI.

This action type enables you to do things like creating entries in external issue management systems using a set of relevant field values.

Question 13

How do you create a POST workflow action?

Answer 13

1. Select the app
2. Name the workflow action with no spaces or special characters
3. Define the label, which will appear in the Event Action menu
4. Determine if your workflow action applies to a field or event type
5. From the Show action in dropdown list, select Event menu
6. From Action type dropdown list, select link
7. Enter the URI of where the user will be directed
8. Open the link in a New window or Current window
9. Select the Link method of post
10. Provide post argument parameters
11. Save

Question 14

Which of the following are required to create a POST workflow action?

Answer 14

• Label
• URI
• Post Arguments