Workflow action converts ? to %3F while sending the URL to browser


I am trying to setup an event action for my Pandion.

While posting the URL to browser, '?' sign is getting converted to %3F which is the HEX for '?' sign. This results in URL not passing the field values like source and dest IP.

If I delete the %3F and put ? sign again and hit refresh, then rerun it then it passes the values properly and Pandion is able to search the data.

URL mentioned in Workflow action:

Actual URL when it gets posted in another window:

Do you see the change after ? Anyone else faced this while posting URL from workflow actions??

0 Karma


Can you paste your configuration as seen by btool?

./bin/splunk btool workflow_actions list <workflow action stanza name>

The one I just created doesn't exhibit the behavior you describe, and its btool output looks like:

display_location = event_menu
fields = *
label = 610627
link.method = get = blank
link.uri =
type = link

I ask for the btool output to ensure there isn't some other configuration file taking precedence from the configuration you're looking at.

0 Karma


is there any ? in https:///#/search/ ?

0 Karma


I just updated my question. Thanks for looking in

It's https://IP_address/#/search/UUID?sip=$src_ip$&from_time=$_time$

0 Karma