Splunk Enterprise Security

How to modify the behavior of a Workflow Action to show a modal box when clicked?

JohannLiebert92
Path Finder

Hi everyone,

I am trying to modify the behavior of my custom workflow action. I would like it to show a modal box for some user input before sending it to a URL. I've seen similar behavior in Splunk Enterprise Security under the Incident Review page. When a user clicks the 'Add Event to Investigation' action, it shows a modal box first. May I know how could I achieve the same behavior? Thank you

p/s. I have created a Modal Box View following this link
https://www.hurricanelabs.com/blog/splunk-custom-modal-view-creation-part-1

0 Karma
1 Solution

LukeMurphey
Champion

This is tricky.

This isn't easy/possible to do with default workflow actions. Incident Review does this by essentially including a custom workflow action system.

You might be able to do this by rendering your data in a table and them employing a custom cell renderer. Your renderer should include a link or something that you can bind a click handler too. Then, you should have some Javascript that assigns a click handler to that link and shows the dialog. This won't show up in your workflows action dropdown, but it should work.

P.S. I asked for an enhancement to do easier in Core Splunk. Feel free to ask them too.

View solution in original post

LukeMurphey
Champion

This is tricky.

This isn't easy/possible to do with default workflow actions. Incident Review does this by essentially including a custom workflow action system.

You might be able to do this by rendering your data in a table and them employing a custom cell renderer. Your renderer should include a link or something that you can bind a click handler too. Then, you should have some Javascript that assigns a click handler to that link and shows the dialog. This won't show up in your workflows action dropdown, but it should work.

P.S. I asked for an enhancement to do easier in Core Splunk. Feel free to ask them too.

JohannLiebert92
Path Finder

Thanks for the feedback. I thought so. As a workaround, I set it in a custom dashboard to pop the Modal View on click.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...