 
					
				
		
Is there a way I can make a workflow action in order to search Google for every field? My problem right now is that when I put in the URI, I have to pass ONE specific field. Is there a way to pass in whatever field is being looked at?
 
					
				
		
hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf
[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link
the above is in screenshots, you can also google the field value for example:
[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link


hope it helps
 
					
				
		
You cannot use workflow to create a search for "every" field but you can make one for "any" field.  So if you really mean "every field" (which is what you said), you cannot.
 
					
				
		
I downvoted this post because wrong answer.
 
					
				
		
Check above to see how to do it
 
					
				
		
hello there:
like this?
$SPLUNK_HOME$/etc/apps/appName/workflow_actions.conf
[google]
display_location = both
fields = *
label = Google $@field_name$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_name$
type = link
the above is in screenshots, you can also google the field value for example:
[google_value]
display_location = both
fields = *
label = Google $@field_value$
link.method = get
link.target = blank
link.uri = http://www.google.com/search?q=$@field_value$
type = link


hope it helps
 
					
				
		
This is almost what I want. Instead of searching for "JSESSIONID", I would like it to search for the value of "JSESSIONID," or in this case "SD5SL4FF5ADFF1." Is that possible? Thanks.
 
					
				
		
its in the second code i posted
google_value stanza
 
					
				
		
That worked, thanks!
