Splunk® Enterprise

Knowledge Manager Manual

Field values

When you define fields for workflow actions, you can replace field names with the values of named fields. To do this, enclose the field name with a $ prefix and suffix. You can use field name replacement in the label of a workflow action, search queries and views, link GET and POST URLs, and values of POST arguments.

Field value escape

By default, field values are escaped when used in workflow actions, but never escaped in the workflow action label. In certain cases, field value escape is undesirable. In these cases, instead use the $! Prefix with the $ suffix to prevent the field value from being escaped.

For example, if you have a GET workflow action that works with a field named http, the http field has fully-formed HTTP addresses as values. For this workflow action to open a new browser window for the HTTP address value of the http field, the workflow action does not work if it opens the new window with an escaped HTTP address.

Example - Passing an HTTP address to a separate browser window

You have a GET workflow action that works with a field named http. The http field has fully formed HTTP addresses as values. This workflow action opens a new browser window that points at the HTTP address value of the http field. The workflow action does not work if it opens the new window with an escaped HTTP address.

To prevent the HTTP address from escaping, use the $! prefix. In Settings, where you might normally set URI to $http$ for this workflow action, instead set it to $!http$.

Last modified on 14 July, 2023
About workflow actions in Splunk Web   Set up a GET workflow action

This documentation applies to the following versions of Splunk® Enterprise: 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters