A workflow action can also link to an external site, using information from an event.
Let's imagine that your organization has some other web-based tool. If that tool can accept arguments via GET or POST requests, then we can link directly to it from the Splunk results.
Create a new workflow action as we did in the previous example, but change Action type to link. The options change to those shown in the following screenshot:
Splunk will encode any variables in the URL so that special characters survive. If you need a variable to not be encoded—for instance, if the value is actually part of the URL—add an exclamation point before the variable name, like this:
$!user$
If Link method is set to POST, then more input fields appear, allowing you to specify post arguments like this:
Choosing this workflow action will open a new window with the URL that we specified, either in the current window or in a new window, according to the value of Open link in.
The fields used by a workflow action can also come from automatic lookups. This is useful in cases where the external tool needs some piece of information that is not in your events, but can be derived from your events.