Which workflow action uses POST to send event data to an external system?
Short answer
A Use the field values in an HTTP error event to create a new ticket in an external system.
Question
Key Takeaways
The exam tests distinguishing between GET, POST, and Search workflow actions; the trap is confusing POST with a web lookup or secondary search.
POST workflow actions in Splunk send data from events to an external system, commonly to create or update resources like tickets. The community consensus is option A, because creating a ticket in an external system requires submitting field values via an HTTP POST.
Common mistake: Choosing C, 'Launch secondary Splunk searches,' because it also uses event field values; however, that is the Search workflow action, not POST.
Expert Analysis
Why the Answer Is Correct
A POST workflow action sends an HTTP POST request to an external endpoint, carrying field values from the event as the request body. Creating a new ticket in an external system requires pushing data to that system, which is exactly what a POST request is designed for. Comment [1] confirms this by stating that POST is used when you need to send data to a server to create or update a resource.
Why the Other Options Are Wrong
Options B and D are GET-style actions: they open a URL with field values as query parameters to retrieve information, not to submit data. Option C is a Search workflow action, which launches a secondary Splunk search using field values from selected events; it does not involve an external HTTP POST. Comment [2] categorizes the options by method, listing POST for ticket creation, GET for lookups, and Search for secondary searches.
Community Comment Notes
The highest-liked comment [1] clearly explains the semantics of a POST action and directly supports option A. Comment [2] provides a helpful mapping of the four options to their workflow action types. One user voted for C, likely because both A and C use field values, but Splunk documentation separates external HTTP actions from internal search actions, making A the correct choice.
Official Reference
- https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutworkflowactions
- https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configureworkflowactions
These links open the official vendor documentation in a new tab.
Exam Strategy
Remember the simple mapping: GET = retrieve/lookup, POST = submit/create/update, Search = run a Splunk search. When an option describes creating an external ticket or resource, the answer must be POST, regardless of how many field values are involved.
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Dogeo 👍 3 Answered AA POST action is used when you need to send data to a server to create or update a resource. In this example, creating a new ticket in an external system involves submitting data (e.g., field values from an HTTP error event), which aligns with the use of a POST request.
-
S_E_A_N 👍 2A. POST B. GET C. Search D. GET
-
jim22444 👍 1 Answered CC
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SPLK-1002 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SPLK-1002 Practice Test →