Is there a way I can make a workflow action in order to search Google for every field? My problem right now is that when I put in the URI, I have to pass ONE specific field. Is there a way to pass in whatever field is being looked at?
hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf
[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link
the above is in screenshots, you can also google the field value for example:
[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link
hope it helps
You cannot use workflow
to create a search for "every" field but you can make one for "any" field. So if you really mean "every field" (which is what you said), you cannot.
I downvoted this post because wrong answer.
Check above to see how to do it
hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf
[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link
the above is in screenshots, you can also google the field value for example:
[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link
hope it helps
This is almost what I want. Instead of searching for "JSESSIONID", I would like it to search for the value of "JSESSIONID," or in this case "SD5SL4FF5ADFF1." Is that possible? Thanks.
its in the second code i posted
google_value stanza
That worked, thanks!