SPLK-1002 practice question 7 of 35

Which of the following are required to create a POST workflow action?

Full set: 297 questions

Domain Workflow Actions and Data Models

Answer options
A: Label, URI, search string.
B: XMI attributes, URI, name.
C: Label, URI, post arguments. Correct answer
D: URI, search string, time range picker.
Correct Answer:
C. Label, URI, post arguments.
Explanation

A POST workflow action is designed to send data from a Splunk event to an external web resource via an HTTP POST request. To configure this, three core components are required:
1. Label: The user-facing text for the action link that appears in the event details.
2. URI: The destination URL endpoint that will receive the POST request.
3. Post arguments: The key-value pairs that form the body of the POST request, typically using values extracted from the event fields. These arguments are essential for transmitting the relevant data.

Why Incorrect

A. A search string is a required parameter for a search workflow action, not a POST link action.
B. XMI attributes are unrelated to workflow action configuration. While a name (stanza name) is required, this option omits the essential post arguments.
D. The search string and time range picker are parameters used specifically for configuring search workflow actions.

References

1. Splunk Enterprise Documentation. Knowledge Manager Manual, "Define workflow actions in Splunk Web". In the section "Create a new workflow action," the configuration fields for a Link action with the POST method explicitly require a Label, URI, and the definition of POST arguments (Name and Value pairs).

2. Splunk Enterprise Documentation. Admin Manual, "workflowactions.conf". The specification for a link-based workflow action shows that to create a POST action, the link.method must be set to post. When this is set, link.postargs. settings are used to define the post arguments. The label and uri attributes are also listed as required settings for the action.

Scroll to Top