topic Re: Triggering workflow action for use in a report in Splunk Search

Triggering workflow action for use in a report

jlsantini — Wed, 04 Dec 2024 17:28:17 GMT

Hi,

We installed the #AbuseIPDB app in our Splunk cloud instance. I created a workflow action called jodi_abuse_ipdb using the documentation provided in the app

Label: Check $ip$ with AbuseIPDB Apply only to: ip Search string: |makeresults|abuseipdbcheck ip=$ip$

I'd like to be able to use this for a report but I haven't figured out how trigger to call this workflow action to provide results. I've done Google searches and I've tried a number of things. I am hoping someone in the community might be able to help.

Thank you!

Jodi

Re: Triggering workflow action for use in a report

jlsantini — Wed, 04 Dec 2024 16:18:35 GMT

Here my workflow action:

This is the search I created for my report:

index=oht_f5 request_status!="passed" workflow action="jodi_abuse_ipdb"

I get 0 results. When I take off the workflow action piece, I get 635 results in 15 minutes.

Re: Triggering workflow action for use in a report

jlsantini — Wed, 04 Dec 2024 16:37:56 GMT

My end goal is to be able to use the AbuseIDB API to look up IP addresses and give back information rather than maintaining spreadsheet lookup table. I was able to pull the blacklist data from AbuseIPDB as a CSV and my report using the CSV lookup works. I'm trying to get data on IPs, blacklist or not, leveraging the API.

I want a report that looks like the one I have for blacklisted IPs.

Re: Triggering workflow action for use in a report

richgalloway — Wed, 04 Dec 2024 19:23:36 GMT

Workflow actions are an interactive feature used in search results to perform something on an event. See https://dev.splunk.com/enterprise/docs/devtools/customworkflowactions and https://docs.splunk.com/Documentation/Splunk/9.3.2/Knowledge/CreateworkflowactionsinSplunkWeb#Control_workflow_action_appearance_in_field_and_event_menus for more information.

That said, workflow actions are not applicable to reports.

If you put the report in a dashboard, then you add a drilldown that uses the same search as your workflow action.

Re: Triggering workflow action for use in a report

jlsantini — Wed, 04 Dec 2024 19:26:21 GMT

Thank you @richgalloway I appreciate the information. It looks like I was trying to do something that isn't possible. I'll review the documentation you sent and look at trying this as a dashboard.

Thanks again!