Running a new search using values from an event

To build a workflow action, navigate to Settings | Fields | Workflow actions and click on New. You are presented with a form as seen in the following screenshot:

Let's walk through the following fields:

  • Destination app: This is the app where the workflow action definition will live.
  • Name: This is the name used in configuration files. This name cannot contain spaces, but underscores are fine.
  • Label: This is what will appear in the menu. It can contain variables. In this case, we have included $user$, which will be populated with the value of the user field from the event.
  • Apply only to the following ...

Get Implementing Splunk 7 - Third Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.