How to modify the behavior of a Workflow Action to show a modal box when clicked?

[JohannLiebert92]

Hi everyone,

I am trying to modify the behavior of my custom workflow action. I would like it to show a modal box for some user input before sending it to a URL. I've seen similar behavior in Splunk Enterprise Security under the Incident Review page. When a user clicks the 'Add Event to Investigation' action, it shows a modal box first. May I know how could I achieve the same behavior? Thank you

p/s. I have created a Modal Box View following this link
https://www.hurricanelabs.com/blog/splunk-custom-modal-view-creation-part-1

[LukeMurphey · Accepted solution]

This is tricky.

This isn't easy/possible to do with default workflow actions. Incident Review does this by essentially including a custom workflow action system.

You might be able to do this by rendering your data in a table and them employing a custom cell renderer. Your renderer should include a link or something that you can bind a click handler too. Then, you should have some Javascript that assigns a click handler to that link and shows the dialog. This won't show up in your workflows action dropdown, but it should work.

P.S. I asked for an enhancement to do easier in Core Splunk. Feel free to ask them too.

[JohannLiebert92]

Thanks for the feedback. I thought so. As a workaround, I set it in a custom dashboard to pop the Modal View on click.