Which workflow action uses POST to send event data to an external system?
Which of the following examples would use a POST workflow action?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests distinguishing between GET, POST, and Search workflow actions; the trap is confusing POST with a web lookup or secondary search.
POST workflow actions in Splunk send data from events to an external system, commonly to create or update resources like tickets. The community consensus is option A, because creating a ticket in an external system requires submitting field values via an HTTP POST.
Choosing C, 'Launch secondary Splunk searches,' because it also uses event field values; however, that is the Search workflow action, not POST.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A POST workflow action sends an HTTP POST request to an external endpoint, carrying field values from the event as the request body. Creating a new ticket in an external system requires pushing data to that system, which is exactly what a POST request is designed for. Comment [1] confirms this by stating that POST is used when you need to send data to a server to create or update a resource.
Why the Other Options Are Wrong
Options B and D are GET-style actions: they open a URL with field values as query parameters to retrieve information, not to submit data. Option C is a Search workflow action, which launches a secondary Splunk search using field values from selected events; it does not involve an external HTTP POST. Comment [2] categorizes the options by method, listing POST for ticket creation, GET for lookups, and Search for secondary searches.
Community Comment Notes
The highest-liked comment [1] clearly explains the semantics of a POST action and directly supports option A. Comment [2] provides a helpful mapping of the four options to their workflow action types. One user voted for C, likely because both A and C use field values, but Splunk documentation separates external HTTP actions from internal search actions, making A the correct choice.
Official Reference
Exam Strategy
Remember the simple mapping: GET = retrieve/lookup, POST = submit/create/update, Search = run a Splunk search. When an option describes creating an external ticket or resource, the answer must be POST, regardless of how many field values are involved.
Related Analysis
Practice All SPLK-1002 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SPLK-1002 Practice Test →