Extending Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 158

Create a new workflow action as we did in the previous example, but change Action
type to link . The options change to those shown in the following screenshot:
Splunk will encode any variables in the URL so that special characters survive.
If you need a variable to not be encoded—for instance, if the value is actually part
of the URL—add an exclamation point before the variable name, like this:
$!user$
If Link method is set to post , then more input fields appear, allowing you to specify
post arguments like this:
Choosing this workflow action will open a new window with the URL we specified,
either in the current window or in a new window according to the value of Open
link in .
The fields used by a workflow action can also come from automatic
lookups. This is useful in cases where the external tool needs some
piece of information that is not in your events, but can be derived
from your events.