---
title: Splunk event actions
description: When reviewing Splunk logs, you can rapidly create security events and security incidents from any item in the log using the Event Actions.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/event-actions.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [ServiceNow Security Operations add-on for Splunk overview, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Splunk event actions

When reviewing Splunk logs, you can rapidly create security events and security incidents from any item in the log using the Event Actions.

Clicking either of these actions creates a manual search command populated with the data in the log entry, and run it to generate the new record.

These actions are easily configured to add fields in your normalized data. Within Splunk, using **Settings** > **Fields** > **Workflow Actions**, you can select and edit either of these actions using the manual search fields.

You can choose where the action is shown, for what fields, and modify the search string that contains a search command to create your record.