https://community.splunk.com/t5/Knowledge-Management/How-to-apply-quot-Event-Actions-quot-to-multiple-events/m-p/237291#M6823 <P>If an event is expanded in Splunk, there is button 'Event Actions'. Its good and handy if I want to apply it on a single event but cases where I have a bunch of events, how to apply it simultaneously on all of them?</P> Wed, 23 Nov 2016 21:16:41 GMT kausar 2016-11-23T21:16:41Z https://community.splunk.com/t5/Knowledge-Management/How-to-apply-quot-Event-Actions-quot-to-multiple-events/m-p/237291#M6823 <P>If an event is expanded in Splunk, there is button 'Event Actions'. Its good and handy if I want to apply it on a single event but cases where I have a bunch of events, how to apply it simultaneously on all of them?</P> Wed, 23 Nov 2016 21:16:41 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-apply-quot-Event-Actions-quot-to-multiple-events/m-p/237291#M6823 kausar 2016-11-23T21:16:41Z https://community.splunk.com/t5/Knowledge-Management/How-to-apply-quot-Event-Actions-quot-to-multiple-events/m-p/237292#M6824 <P>The way that I did this was to create my script as an alert script and then I was able to call it manually from any search as well as use it as a <CODE>Workflow</CODE> (AKA <CODE>Event Action</CODE>) with the same syntax. See this answer for more details:</P> <P><A href="https://answers.splunk.com/answers/41949/passing-search-results-to-external-python-script.html">https://answers.splunk.com/answers/41949/passing-search-results-to-external-python-script.html</A></P> Sat, 11 Mar 2017 00:45:20 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-apply-quot-Event-Actions-quot-to-multiple-events/m-p/237292#M6824 woodcock 2017-03-11T00:45:20Z