Knowledge Management

How to make a workflow action that performs a Google Search for every field?

JustRoot
Path Finder

Is there a way I can make a workflow action in order to search Google for every field? My problem right now is that when I put in the URI, I have to pass ONE specific field. Is there a way to pass in whatever field is being looked at?alt text

1 Solution

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

View solution in original post

woodcock
Esteemed Legend

You cannot use workflow to create a search for "every" field but you can make one for "any" field. So if you really mean "every field" (which is what you said), you cannot.

0 Karma

JustRoot
Path Finder

I downvoted this post because wrong answer.

0 Karma

JustRoot
Path Finder

Check above to see how to do it

0 Karma

adonio
Ultra Champion

hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf

[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link

the above is in screenshots, you can also google the field value for example:

[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link

alt text

alt text

hope it helps

JustRoot
Path Finder

This is almost what I want. Instead of searching for "JSESSIONID", I would like it to search for the value of "JSESSIONID," or in this case "SD5SL4FF5ADFF1." Is that possible? Thanks.

0 Karma

adonio
Ultra Champion

its in the second code i posted
google_value stanza

0 Karma

JustRoot
Path Finder

That worked, thanks!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...