field_actions.conf

field_actions.conf

Field_actions.conf controls what actions are available in Splunk Web inline with events.

To edit this configuration for your local Splunk server, make your edits in $SPLUNK_HOME/etc/bundles/local/field_actions.conf.

You can create this file by copying examples from $SPLUNK_HOME/etc/bundles/README/field_actions.conf.example.

Never edit files in our default bundle in $SPLUNK_HOME/etc/bundles/default or your changes may be overwritten in an upgrade.

field_actions.conf.spec

# This file contains all possible options for a "field_actions" file.
#
# SplunkWeb must be restarts when you make changes.  Check the 
# web_service.log to catch errors in your stanzas.
# A configuration looks like:
[<field_action_name>]
metaKeys = foo,bar
uri = http://google.com?q={$foo}+{$bar}+{$baz}
label="search for foo,bar,baz in google"
metaKeys = <string>
  * Comma-separated list of metadata keys that are required for the action to display in the SplunkWeb. 
    Keys whose names are present in the metaKeys list are then usable in the uri field.
uri = <string> 
  * URI, either beginning with http://,  https://, or for URLs on the Splunk front-end, beginning with "/". 
    If present, the user clicking on the action in the SplunkWeb, will result in them loading this URL. 
target = <string>
  * Only meaningful if uri is present, if set to _self,  the webapp will load in the current window. If set to _blank, it'll open a new window. If set to fooWindow, will reuse any window named fooWindow and open a new window if no such window exists. 
method = <string> (GET)
  * Only meaningful if uri is present. This can be either GET or POST, and is the HTTP method that should be used with the given url. 
payload = <string>
  * only meaningful for POST methods.  This is a method for allowing the user to customize the values passed over, event={$_raw}&myhost={$host} ... key value pairs are separated with &.
term = <string>
  * An alternative to uri. If present, the action becomes a search action.   Assuming you had metaKeys values of rhost and ruser, you could have term=authentication failure {$rhost} {$ruser}. 
  When clicked, it will run the given search.
  
alwaysReplace = true
  * This should be true or not in the stanza.  If it is present and set to true, the term will replace the current search bar term instead of appending it to the search.

• Was this topic useful?
• Post a comment