Knowledge Management

GET Workflow Action - define different URI based on host value?

sgtquezada
New Member

I am trying to configure a GET workflow action that decodes a session Id. The problem is that you have to pass the correct environment in the URI in order to properly decode it. What I am looking for is a way to look up the host value and then determine the proper URI in the workflow action.

Does anyone if this is possible? Can this be done via a secondary search of some sort?

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

The easiest way to achieve this is to create a lookup table that creates the URI itself or a fragment of it.

The documentation for this feature is at: http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources

Once your lookup is configured, your workflow action should be based on the looked-up field. I'd suggest making the lookup automatic so that the new field is always present in data that should have it.

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...