Knowledge Management

How to make a workflow action that performs a Google Search for every field?

JustRoot
Path Finder

Is there a way I can make a workflow action in order to search Google for every field? My problem right now is that when I put in the URI, I have to pass ONE specific field. Is there a way to pass in whatever field is being looked at?alt text

1 Solution

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

View solution in original post

woodcock
Esteemed Legend

You cannot use workflow to create a search for "every" field but you can make one for "any" field. So if you really mean "every field" (which is what you said), you cannot.

0 Karma

JustRoot
Path Finder

I downvoted this post because wrong answer.

0 Karma

JustRoot
Path Finder

Check above to see how to do it

0 Karma

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

JustRoot
Path Finder

This is almost what I want. Instead of searching for "JSESSIONID", I would like it to search for the value of "JSESSIONID," or in this case "SD5SL4FF5ADFF1." Is that possible? Thanks.

0 Karma

adonio
Ultra Champion

its in the second code i posted
google_value stanza

0 Karma

JustRoot
Path Finder

That worked, thanks!

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...