Running a new search using values from an event

To build a workflow action, navigate to Settings | Fields | Workflow actions and click on New. You are presented with a form as seen in the following screenshot:

Let's walk through the following fields:

  • Destination app: This is the app where the workflow action definition will live.
  • Name: This is the name used in configuration files. This name cannot contain spaces, but underscores are fine.
  • Label: This is what will appear in the menu. It can contain variables. In this case, we have included $user$, which will be populated with the value of the user field from the event.
  • Apply only to the following ...

Get Improving Your Splunk Skills now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.