If an event is expanded in Splunk, there is button 'Event Actions'. Its good and handy if I want to apply it on a single event but cases where I have a bunch of events, how to apply it simultaneously on all of them?
The way that I did this was to create my script as an alert script and then I was able to call it manually from any search as well as use it as a Workflow (AKA Event Action) with the same syntax. See this answer for more details:
