SPLK-1002 · Question #115
What is a limitation of searches generated by workflow actions?
The correct answer is D. Searches generated by workflow action run with the same permissions as the user running them.. Searches launched by Splunk workflow actions inherit the permissions of the user who triggers them, meaning they cannot access data beyond that user's role-based access.
Question
What is a limitation of searches generated by workflow actions?
Options
- ASearches generated by workflow action cannot use macros.
- BSearches generated by workflow actions must be less than 256 characters long.
- CSearches generated by workflow action must run in the same app as the workflow action.
- DSearches generated by workflow action run with the same permissions as the user running them.
How the community answered
(29 responses)- A3% (1)
- C3% (1)
- D93% (27)
Why each option
Searches launched by Splunk workflow actions inherit the permissions of the user who triggers them, meaning they cannot access data beyond that user's role-based access.
Macro usage is supported within searches generated by workflow actions and is not a documented limitation.
There is no documented 256-character limit on searches generated by workflow actions.
Workflow action searches can be configured to open in a different app context and are not restricted to the originating app.
When a workflow action triggers a search, it executes under the identity and permission set of the user who clicked the action. This means the search is bound by that user's role capabilities and index access - it does not run with elevated or app-owner privileges.
Concept tested: Splunk workflow action search permission limitations
Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Workflowactionsoverview
Topics
Community Discussion
No community discussion yet for this question.