Splunk Core Certified Power User — Question 119

Which of the following examples would use a POST workflow action?

Answer options

• A. Use the field values in an HTTP error event to create a new ticket in an external system.
• B. Open a web browser to look up an HTTP status code.
• C. Launch secondary Splunk searches that use one or more field values from selected events.
• D. Perform an external IP lookup based on a domain value found in events.

Correct answer: A

Explanation

Answer A is correct because it involves creating a new resource in an external system, which is a typical use case for a POST request. The other options describe actions that do not involve creating or submitting data, making them inappropriate for a POST workflow action.