Splunk Enterprise Security
Highlighted

Splunk Enterprise Security: Why won't a workflow action open in a new search from the Incident Review page?

Explorer

I have made a workflow action item that looks up details on an IP address when there is a threat hit. This works when it is ran from the Search and Reporting app, but when I try to run it from the Incident Review page within Splunk Enterprise Security (ES) it defaults back to ES and does not open it in a new search. Does anyone know why this won't allow me to open in a new search?

0 Karma
Highlighted

Re: Splunk Enterprise Security: Why won't a workflow action open in a new search from the Incident Review page?

Splunk Employee
Splunk Employee

If I read this correctly, you are in IR, you build your own field menu workflow and you want to run a search. You put in a search string that worked correctly before. You are running in the current app context which should be ok.

What view are you using? It is not a mandatory field but when doing an integration of my own, I setting the view field to search and then opened a new window would work decently.

View solution in original post

Highlighted

Re: Splunk Enterprise Security: Why won't a workflow action open in a new search from the Incident Review page?

Explorer

Correct im in Incident Review, I then go to actions and then to the workflow I have created. The work flow is set to open in a new window.

0 Karma
Highlighted

Re: Splunk Enterprise Security: Why won't a workflow action open in a new search from the Incident Review page?

Splunk Employee
Splunk Employee
Highlighted

Re: Splunk Enterprise Security: Why won't a workflow action open in a new search from the Incident Review page?

Explorer

That worked, I didn't type search in the "Open in view" box, I thought that it would have been a drop down selection.

Thanks!

0 Karma