I have a Workflow actions
configuration like this:
Apply only to the following fields: "Work Order ID", Work_Order_ID
Apply only to the following event types: WIN_ET*
Show action in: Both
Action type: link
URI: http://wo?$Work Order ID$
Open link in: New window
Link method: get
After a restart, I expected that I would have a new workflow on the Statistics
tab when I click on any Work Order ID
field, but NO!
index=* eventtype=WIN_ET* | eval Work_Order_ID="W123456789" | eval "Work Order ID" = Work_Order_ID | table W*O
Instead, I have to click on the Events
tab, then click the >
button under i
(turning it into v
) and then scroll down to the fields area of an event, click on the Actions
column's v
control. Here is the ONLY place the Lookup Work Order W123456789
workflow menu item appears. It does not even appear under the workflows accessed by clicking on the Event Actions v
button.
What's up with that? I absolutely must have a Work Order URL lookup available on the Statistics
tab. How can I do this? Do I need to configure a drilldown
action? I am trying to avoid using a form/dashboard; I need something that works directly from the Statistics
tab.
As others have mentioned, the Event/Field workflows are not available in the statistics tab/table view. The data/rows shown here are not directly linked to Events in this view, i.e. you are seeing data from events but the information about the data to the event is not present there. Think of this like looking at store bought food presented on a snack tray, but then you can't check the nutrition facts looking at the food because the food is without the packaging.
I could see how being able to have workflows on fields in Statistics (if possible) would be useful. If this is a feature you'd like to request, note that we have an internal Enhancement Request: SPL-119276 .
To request this feature (and show support for it), please create a Support ticket with Splunk mentioning this Splunk Answer page and ask to be added to ER SPL-119276. Support will link your request to this ER and close the support case (which basically functions like an upvote for the ER).
Happy Splunking!
I was under same impression as Martin. I haven't seen workflows on stats tab. Would be cool if it was there. I think you are going to need to go form/drilldown route.
The statistics tab doesn't display any workflow actions.
Do note that there are other workflows on that tab, but mine is not there.
Also, permissions are app
-level; maybe I will try Global
...