When you define fields for workflow actions, you can replace field names with the values of named fields. To do this, enclose the field name with a
$ prefix and suffix. You can use field name replacement in the label of a workflow action, search queries and views, link GET and POST URLs, and values of POST arguments.
Field value escape
By default, field values are escaped when used in workflow actions, but never escaped in the workflow action label. In certain cases, field value escape is undesirable. In these cases, instead use the
$! Prefix with the
$ suffix to prevent the field value from being escaped.
For example, if you have a GET workflow action that works with a field named http, the http field has fully-formed HTTP addresses as values. For this workflow action to open a new browser window for the HTTP address value of the http field, the workflow action does not work if it opens the new window with an escaped HTTP address.
Example - Passing an HTTP address to a separate browser window
You have a GET workflow action that works with a field named
http field has fully formed HTTP addresses as values. This workflow action opens a new browser window that points at the HTTP address value of the
http field. The workflow action does not work if it opens the new window with an escaped HTTP address.
To prevent the HTTP address from escaping, use the
$! prefix. In Settings, where you might normally set URI to
$http$ for this workflow action, instead set it to
About workflow actions in Splunk Web
Set up a GET workflow action
This documentation applies to the following versions of Splunk Cloud Platform™: 9.0.2305 (latest FedRAMP release), 9.1.2308, 9.1.2312