Splunk users can easily jump into Graphistry investigations without much thinking from any Splunk search result or dashboard, even if they don't know which ones are available ahead of time. To do so, you simply register Graphistry templates as Splunk workflow actions.

To make a template appear as a Workflow Action on a specific kind of event:

1. In Splunk: Settings -> Event Types -> new:
   • Search string: The events you want the template to appear on (if you don't hav event types already known). Ex: "index=calls phone=*".
   • Tag(s): An identifier to associate with these events
2. In Splunk: Settings -> Fields -> Workflow actions -> new
   • Label: What appears in Splunk's action menu. Ex: `Check Graphistry for Phone 360: $phone$`
   • Apply only to fields, tags: the search result column and/or tag from Step 1
   • Show action in: Both
   • Action type: Link
   • Link configuration: Template URL, using `$fld$` to populate values. Ex: `https://my_graphistry.com/pivot/template?investigation=453d190914cf9fa0&pivot[0][events][0][phone]=$phone$&pivot[0][events][0][time]=$time_epoch$`
   • Open link in: New window
   • Link method: get