Knowledge Management

Missing Event/Field workflow from "Statistics" tab?

woodcock
Esteemed Legend

I have a Workflow actions configuration like this:

Apply only to the following fields: "Work Order ID", Work_Order_ID
Apply only to the following event types: WIN_ET*
Show action in: Both
Action type: link
URI: http://wo?$Work Order ID$
Open link in: New window
Link method: get

After a restart, I expected that I would have a new workflow on the Statistics tab when I click on any Work Order ID field, but NO!

index=* eventtype=WIN_ET* | eval Work_Order_ID="W123456789" | eval "Work Order ID" = Work_Order_ID | table W*O

Instead, I have to click on the Events tab, then click the > button under i (turning it into v) and then scroll down to the fields area of an event, click on the Actions column's v control. Here is the ONLY place the Lookup Work Order W123456789 workflow menu item appears. It does not even appear under the workflows accessed by clicking on the Event Actions v button.

What's up with that? I absolutely must have a Work Order URL lookup available on the Statistics tab. How can I do this? Do I need to configure a drilldown action? I am trying to avoid using a form/dashboard; I need something that works directly from the Statistics tab.

rkantamaneni_sp
Splunk Employee
Splunk Employee

As others have mentioned, the Event/Field workflows are not available in the statistics tab/table view. The data/rows shown here are not directly linked to Events in this view, i.e. you are seeing data from events but the information about the data to the event is not present there. Think of this like looking at store bought food presented on a snack tray, but then you can't check the nutrition facts looking at the food because the food is without the packaging.

I could see how being able to have workflows on fields in Statistics (if possible) would be useful. If this is a feature you'd like to request, note that we have an internal Enhancement Request: SPL-119276 .

To request this feature (and show support for it), please create a Support ticket with Splunk mentioning this Splunk Answer page and ask to be added to ER SPL-119276. Support will link your request to this ER and close the support case (which basically functions like an upvote for the ER).

Happy Splunking!

0 Karma

snoobzilla
Builder

I was under same impression as Martin. I haven't seen workflows on stats tab. Would be cool if it was there. I think you are going to need to go form/drilldown route.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The statistics tab doesn't display any workflow actions.

0 Karma

woodcock
Esteemed Legend

Do note that there are other workflows on that tab, but mine is not there.

0 Karma

woodcock
Esteemed Legend

Also, permissions are app-level; maybe I will try Global...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...