Knowledge Management

How to make a workflow action that performs a Google Search for every field?

JustRoot
Path Finder

Is there a way I can make a workflow action in order to search Google for every field? My problem right now is that when I put in the URI, I have to pass ONE specific field. Is there a way to pass in whatever field is being looked at?alt text

1 Solution

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

View solution in original post

woodcock
Esteemed Legend

You cannot use workflow to create a search for "every" field but you can make one for "any" field. So if you really mean "every field" (which is what you said), you cannot.

0 Karma

JustRoot
Path Finder

I downvoted this post because wrong answer.

0 Karma

JustRoot
Path Finder

Check above to see how to do it

0 Karma

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

JustRoot
Path Finder

This is almost what I want. Instead of searching for "JSESSIONID", I would like it to search for the value of "JSESSIONID," or in this case "SD5SL4FF5ADFF1." Is that possible? Thanks.

0 Karma

adonio
Ultra Champion

its in the second code i posted
google_value stanza

0 Karma

JustRoot
Path Finder

That worked, thanks!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...