Workflow Actions

Workflow actions add custom menu items to search results. When a user clicks on an event, workflow actions appear in the event's action menu.

There are three types: GET link (opens a URL), POST link (sends data to a URL), and Search link (runs a new Splunk search with context from the event).

A common use case is creating a "WHOIS Lookup" workflow action that opens a WHOIS website with the IP address from the event pre-filled.