Splunk Enterprise Security

Trigger an action manually


I need an action for an incident responder to send a selected event's data via email. I can define notable actions, but they will be triggered automatically when a notable is created. How can I do this manually?

Labels (2)
0 Karma


One option would be to create a custom adaptive action (AR), which can be manually invoked by the responder. [ Your AR code would need to then collect the required information from the correlation search/search events and send/email as needed]

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...