Splunk Search

How to create a workflow action that triggers a custom search for a particular event for further analysis?

crypt0
New Member

Hi,

I am trying to do the following, but haven't been able to figure out how.

For a particular event, I want to trigger some analysis of the event. The analysis may involve performing additional searches using Splunk, and combining some of the results from these searches. Then finally present the final results to the user.

I looked at various options such as workflow actions, Splunk app or add-on, etc, but not exactly sure how to do that. The best I can come up with is

  • Create a Workflow action that triggers a POST to a URI
  • Create a Splunk app that listens on that URI to receive the POST
  • From the Splunk app, use the Splunk REST API to search based on the event received
  • Repeat search until all information is gathered and analyzed
  • Present the results in the Splunk app

Is this what I need to do? What are my options?

Thanks for your help!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Here's how you launch a custom new search from an event of your current search: http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/CreateworkflowactionsinSplunkWeb#Set_up_...

martin_mueller
SplunkTrust
SplunkTrust

In that case you're not looking for a workflow action, rather for a small program to do the looping for you. Out of the box Splunk doesn't do loops.

That small program could be a custom search command, or an external program using the REST API / various SDKs.

0 Karma

crypt0
New Member

Thanks Martin. I saw that as well. AFAICT, unfortunately that doesn't allow me to run the search, process the results dynamically, and re-run another search based on the output of the processing, and reiterate until the final result is obtained. I would like to do these steps automatically in a program.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...