Deployment Architecture

Workflow action converts ? to %3F while sending the URL to browser

varad_joshi
Communicator

I am trying to setup an event action for my Pandion.

While posting the URL to browser, '?' sign is getting converted to %3F which is the HEX for '?' sign. This results in URL not passing the field values like source and dest IP.

If I delete the %3F and put ? sign again and hit refresh, then rerun it then it passes the values properly and Pandion is able to search the data.

URL mentioned in Workflow action:
https://IP_address/#/search/UUID?sip=$src_ip$&from_time=$_time$

Actual URL when it gets posted in another window:
https://IP_address/#/search/UUID%3Fsip=$src_ip$&from_time=$_time$

Do you see the change after ? Anyone else faced this while posting URL from workflow actions??

0 Karma

micahkemp
Champion

Can you paste your configuration as seen by btool?

./bin/splunk btool workflow_actions list <workflow action stanza name>

The one I just created doesn't exhibit the behavior you describe, and its btool output looks like:

[610627]
display_location = event_menu
fields = *
label = 610627
link.method = get
link.target = blank
link.uri = http://192.168.82.169/search?field=value
type = link

I ask for the btool output to ensure there isn't some other configuration file taking precedence from the configuration you're looking at.

0 Karma

mayurr98
Super Champion

is there any ? in https:///#/search/ ?

0 Karma

varad_joshi
Communicator

I just updated my question. Thanks for looking in

It's https://IP_address/#/search/UUID?sip=$src_ip$&from_time=$_time$

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...