Monitoring · CONNECTIONRun Splunk searches and read their results, manage saved searches and users, and read fired alerts.
Explore 14 workflow actions for Splunk, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Start a search and return its search ID.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Create a user with one or more roles.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete a saved search by name.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Cancel and delete a search job.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete a user.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Read the summary of fired alerts, with each alert's trigger count.
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Read one saved search by name.
Read one search job, including whether it is done.
Read a page of a finished search job's results.
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Read one user.
Read saved searches (search configurations).
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Read search jobs.
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Read Splunk users.
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Change a user's email, name, roles, default app, time zone or password.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in Splunk. A saved workflow is not a completed provider action.
