Deployment Architecture

Workflow action and foreign application

Azerty728
Path Finder

I'm on distributed environment with deployment server.

I created an application, outside ES but based on ES result search.

In order to simplify the interaction between the two apps (Es and my app), I added a Workflow action in ES, that points to my app (GET method).
Now I want to package my app. But my workflow action is still (created) in ES.

If I want to incorporate my workflow_actions.conf in my own app directory, how can I make it deploy in ES too ? Because right now, if I deploy my app, it only deploys files on my search heads but not this wworkflow_actions.conf in ES directory.

I hope this is clear enough to be understood.

Regards.

0 Karma
1 Solution

Azerty728
Path Finder

I am answering my own question :
I created my workflow_actions.conf where I put my workflow actions, in my app directory.
Then in metadata/default.meta, I added stanzas of my workflow actions like below, and an export key to the apps where I want my workflow actions appear:

[workflow_actions/View_Notable]
export = SA-ThreatIntelligence

[workflow_actions/Email_generation]
export = SplunkEnterpriseSecurity

So my workflow actions appear where I want to ! (in SA-ThreatIntelligence and Enterprise Security).
That's all.

View solution in original post

0 Karma

Azerty728
Path Finder

I am answering my own question :
I created my workflow_actions.conf where I put my workflow actions, in my app directory.
Then in metadata/default.meta, I added stanzas of my workflow actions like below, and an export key to the apps where I want my workflow actions appear:

[workflow_actions/View_Notable]
export = SA-ThreatIntelligence

[workflow_actions/Email_generation]
export = SplunkEnterpriseSecurity

So my workflow actions appear where I want to ! (in SA-ThreatIntelligence and Enterprise Security).
That's all.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...