https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289991#M43215 <P>If you would like to save the fact that somebody used the <CODE>workflow_action</CODE> called <CODE>Report</CODE> inside of Splunk itself so that you can search what <CODE>Reports</CODE> have been sent, then you would simply find the definition of <CODE>Report</CODE> and add this to the end of it:</P> <PRE><CODE>| collect index=YourNewIndex </CODE></PRE> Tue, 21 Feb 2017 22:19:11 GMT woodcock 2017-02-21T22:19:11Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289989#M43213 <P>In my drill down page, i have an event action called <EM>Report</EM>. when i click this <EM>Report</EM> it triggers an email for few audience with some fields of the event.</P> <P>how can i save this data in splunk, using this <EM>Report</EM> as a field??</P> Wed, 08 Feb 2017 08:54:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289989#M43213 annamareddi 2017-02-08T08:54:43Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289990#M43214 <P>You would like to save the fact that somebody used the <CODE>workflow_action</CODE> called <CODE>Report</CODE> inside of Splunk itself so that you can search what <CODE>Reports</CODE> have been sent?</P> Tue, 21 Feb 2017 22:18:04 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289990#M43214 woodcock 2017-02-21T22:18:04Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289991#M43215 <P>If you would like to save the fact that somebody used the <CODE>workflow_action</CODE> called <CODE>Report</CODE> inside of Splunk itself so that you can search what <CODE>Reports</CODE> have been sent, then you would simply find the definition of <CODE>Report</CODE> and add this to the end of it:</P> <PRE><CODE>| collect index=YourNewIndex </CODE></PRE> Tue, 21 Feb 2017 22:19:11 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-save-the-data-generated-by-event-actions-from-drill-down/m-p/289991#M43215 woodcock 2017-02-21T22:19:11Z