Extending Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 156

Let's walk through the following fields:
• Destination app : This is the app where the workflow action definition
will live.
• Name : This is the name used in configuration files. This name cannot
contain spaces, but underscores are fine.
• Label : This is what will appear in the menu. It can contain variables. In this
case, we have included $user$ , which will be populated with the value of
the user field from the event.
• Apply only to the following fields : This workflow action will only appear
on an event if all fields specified in this list have a value. Show action in
will determine which menus can contain the workflow action.
• Apply only to the following event types : Only show this workflow action
for events that match a particular event type. For instance, if you defined an
event type called login , you might want a custom workflow action to search
for all logins for this particular user over the last week.
• Show action in : The three options are Event menu , Fields menus , and Both .
° The Event menu option is to the left of the event. If Apply only to
the following fields is not empty, the workflow action will only be
present if all of the fields specified are present in the event.
° The Fields menus option falls to the right of each field under the
events. If Apply only to the following fields is not empty, only
the fields listed will contain the workflow action.
° Both will show the workflow action in both places, following the
same rules.
• Action type : The choices here are search or link . We have chosen search .
We will try link in the next section.
• Search string : This is the search template to run. You will probably use
field values here, but it is not required.
• Run in app : If left blank, the current app will be used, otherwise the search
will be run in the app that is specified. You would usually want to leave
this blank.
• Open in view : If left blank, the current view will be used. If you expect
to use an events listing panel on dashboards, you probably want to set
this to flashtimeline .