I am trying to modify the behavior of my custom workflow action. I would like it to show a modal box for some user input before sending it to a URL. I've seen similar behavior in Splunk Enterprise Security under the Incident Review page. When a user clicks the 'Add Event to Investigation' action, it shows a modal box first. May I know how could I achieve the same behavior? Thank you
This isn't easy/possible to do with default workflow actions. Incident Review does this by essentially including a custom workflow action system.
P.S. I asked for an enhancement to do easier in Core Splunk. Feel free to ask them too.