Knowledge Management

How to make a workflow action that performs a Google Search for every field?

JustRoot
Path Finder

Is there a way I can make a workflow action in order to search Google for every field? My problem right now is that when I put in the URI, I have to pass ONE specific field. Is there a way to pass in whatever field is being looked at?alt text

1 Solution

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

View solution in original post

woodcock
Esteemed Legend

You cannot use workflow to create a search for "every" field but you can make one for "any" field. So if you really mean "every field" (which is what you said), you cannot.

0 Karma

JustRoot
Path Finder

I downvoted this post because wrong answer.

0 Karma

JustRoot
Path Finder

Check above to see how to do it

0 Karma

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

JustRoot
Path Finder

This is almost what I want. Instead of searching for "JSESSIONID", I would like it to search for the value of "JSESSIONID," or in this case "SD5SL4FF5ADFF1." Is that possible? Thanks.

0 Karma

adonio
Ultra Champion

its in the second code i posted
google_value stanza

0 Karma

JustRoot
Path Finder

That worked, thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...