First, let's build our workflow action. As before, make a workflow action with Action type set to search as seen in the following screenshot:
Let's step through our values, which are as follows:
- Name: This can be anything. Let's name it after our time frame.
- Label: This is what will appear in the menu. You may notice two special fields, @field_name and @field_value. These two fields only make sense when Show action in is set to Fields menus. There are a number of @variables available to workflow actions. Search http://docs.splunk.com/ for Create workflow actions in Splunk to find the complete documentation. ...
