topic Re: Limit a workflow to a sourcetype in Knowledge Management

Limit a workflow to a sourcetype

mpitts — Fri, 25 Oct 2013 16:58:57 GMT

Is it possible to only display a workflow on a certain sourcetype?

I have a lookup that takes the "EventCode" field in "WinEventLog:Security" sourcetype. However, this field also exists in Application and System logs, but the site the lookup is going to only has information about Security event.

Re: Limit a workflow to a sourcetype

richgalloway — Fri, 25 Oct 2013 18:12:02 GMT

Include the sourcetype in your search statement. For example:

sourcetype="WinEventLog:Security" "EventCode" | ...

Re: Limit a workflow to a sourcetype

mpitts — Fri, 25 Oct 2013 18:30:35 GMT

That doesn't prevent the workflow from displaying in System events.

Re: Limit a workflow to a sourcetype

richgalloway — Fri, 25 Oct 2013 18:39:09 GMT

Then you need to adjust your search to select only the events you want to see (or remove those you don't want to see). For example, 'sourcetype="WinEventLog:Security" LogName="Security" | ...'

Re: Limit a workflow to a sourcetype

mpitts — Fri, 25 Oct 2013 20:40:21 GMT

Its not a search results issue. I have a workflow set up which has "Apply only to the following fields" set to "EventCode". However, this field is available in Security log events and System log events. I want to limit this action to only show for Security log events.

In doing some additional testing I think there may be a different behavior (bug) in version 6. According to the documentation (http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/CreateworkflowactionsinSplunkWeb):

Re: Limit a workflow to a sourcetype

mpitts — Fri, 25 Oct 2013 20:40:29 GMT

"You can set up workflow actions that only apply to events that have a specified field or set of fields. ...you would declare http_status in the Apply only to the following fields setting.

...When more than one field is listed the workflow action is displayed only if the entire list of fields are present in the event."

Based on this information I thought I would be able to accomplish what I want by adding a second field that is not available in the System log, however, no matter what I add here, the workflow action is displayed for ALL events, even ones which do not have either field.

Re: Limit a workflow to a sourcetype

jmsiegma — Wed, 27 Nov 2013 07:26:49 GMT

I have been trying to find the same thing.. Sounds like a great feature request

Re: Limit a workflow to a sourcetype

lguinn2 — Wed, 11 Dec 2013 09:52:13 GMT

i too believe there is a bug - this worked as documented in versions prior to 6.0