When working with events being returned by Splunk, there are often times where there is a need to perform a subsequent operation in order to get more details. Sometimes, performing another search in Splunk is enough, but at other times, you might need to send this data to an external system for further processing.
Splunk provides a feature known as workflow action that can be configured to provide different options, depending on what fields are present in your search results. There are two types of workflow actions currently available: the ability to open a link to a web-based resource and the ability to execute an additional search within Splunk. The link action can be used to search for data in popular search engines or link to ...
