SPLK-1002 · Question #125
When is a GET workflow action needed?
The correct answer is B. To retrieve information from an external resource. A GET workflow action opens a URL in a browser to retrieve or display information from an external resource based on field values. It is distinct from POST actions, which send data to an external endpoint.
Question
When is a GET workflow action needed?
Options
- ATo send field values to an external resource.
- BTo retrieve information from an external resource.
- CTo use field values to perform a secondary search.
- DTo define how events flow from forwarders to indexes.
How the community answered
(38 responses)- A5% (2)
- B89% (34)
- C3% (1)
- D3% (1)
Why each option
A GET workflow action opens a URL in a browser to retrieve or display information from an external resource based on field values. It is distinct from POST actions, which send data to an external endpoint.
Sending field values to an external resource for processing describes a POST workflow action, which submits data via an HTTP POST request rather than fetching a URL.
A GET workflow action constructs a URL using field values from an event and opens it in the browser, allowing the user to retrieve information from an external resource such as a threat intelligence database, WHOIS lookup, or ticketing system. The action uses the HTTP GET method, meaning it fetches data rather than submitting it.
Using field values to perform a secondary search describes a Search workflow action, which constructs and runs a new Splunk search rather than querying an external URL.
Defining how events flow from forwarders to indexers is an indexer routing and forwarding configuration concern, unrelated to workflow actions.
Concept tested: GET workflow action retrieving external resource data
Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutworkflowactions
Topics
Community Discussion
No community discussion yet for this question.