
actions dataset function
Use the actions()
function with the into
command to interact with the Actions service to trigger actions, such as a webhook action or an email action.
For information about the Actions service, see Act on your data using Splunk Cloud Services on the Splunk Developer Portal.
Syntax
The required syntax is in bold.
- actions
- (
- <trigger>,
- <trigger-once>,
- [<filter-condition>],
- [<metadata>]
- )
The arguments must be enclosed in parentheses ( ).
Required arguments
- trigger
- Syntax: <trigger>
- Description: The name of a trigger that you want to invoke.
- trigger-once
- Syntax: <boolean>
- Description: A Boolean value that specifies whether to activate the trigger once for all events in the search or once for each event. The default is
false
, which activates the trigger one time for all events in the search.
Optional arguments
- filter-condition
- Syntax: <expression>
- Description: The condition, specified as an expression, to check before activating the trigger.
- Example:
error=500
- metadata
- Syntax: <object>
- Description: Additional metadata needed by the Actions service. The format of the metadata is similar to a JSON object, and uses the format
{field: value}
.- Field names that contain characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single quotation marks. This includes field names with spaces.
- String values must be enclosed in double quotation marks.
- Example:
{locale: "en-AU", city: "Sydney"}
Usage
The actions()
function is a sink function. Sink functions are functions that consume events from a dataset.
To use named arguments, you must specify the argument names before the argument values. For example:
...actions(trigger:mytrigger, trigger_once:true, condition:error=500, metadata:{locale: "en_AU", city: "Sydney"})
Examples
The following example specifies to use the mytrigger
trigger to fire once for every event that has 500 in the error
field. The metadata passed to the Actions service includes a description and a name.
...| into actions(mytrigger, true, error=500, {locale: "en_AU", city: "Sydney"})
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!