Configure workflow rules

Learn how to configure workflow rules that align operation display names with Business Transactions in Splunk Observability Cloud.

Configure workflow rules to align operation display names in Splunk Observability Cloud with the Business Transactions that operators, dashboards, detectors, and runbooks depend on.

A workflow rule changes how matching operations appear in workflow analysis. Configure only the rules identified by the Business Transaction compliance analysis.

Concept mapping

Splunk AppDynamics Splunk Observability Cloud

Business Transaction detection rule

Workflow rule

Auto-discovery rule

Default operation behavior

Custom match rule

Custom workflow rule

Naming scheme

Custom, tag-based, or operation-based naming

Entry-point type

HTTP method, endpoint, service, and span attributes

Select the rule type

Rule type Use when

Custom

Matching operations require one approved literal display name

Tag

A stable, bounded span attribute contains the required display name

Operation

The existing operation name already matches the approved workflow name

Do not use a tag containing user identifiers, request identifiers, raw paths, or other unbounded values.

Configure the rules

  1. Review the Business Transaction compliance report and the source detection rules.

  2. Identify the operations that must share a display name.

  3. Select the target service and applicable environments.

  4. Select the rule type.

  5. Define the matching operations or stable attribute.

  6. Set the approved display name.

  7. Place specific rules before default or broader rules.

  8. Configure exclusions for operations to keep out of workflows.

  9. Enable the rules through the approved change process.

  10. Generate representative traffic.

For example, if Splunk AppDynamics reports all movie CRUD requests as /movie, a custom workflow rule can consolidate GET /movie, POST /movie, GET /movie/{id}, and DELETE /movie/{id} under the display name /movie.

Verify the Business Transactions

For each configured rule:

  1. Generate representative traffic that matches the rule.

  2. In Splunk Observability Cloud, select APM > Overview > Business Transactions.

  3. Confirm that the approved Business Transaction name appears.

  4. Open the Business Transaction and verify that it contains the expected traces, services, and endpoints.

  5. From the Business Transaction’s actions menu, select View associated Business Transaction rule. Confirm that the intended rule generated the Business Transaction.

  6. If a dashboard or detector filters by sf_workflow, confirm that the filter value exactly matches the generated Business Transaction name and returns data.

Confirm that:

  • Consolidate HTTP method differences only when approved.

  • GraphQL or wildcard operations use the intended Business Transaction name.

  • Keep excluded health checks, database operations, and internal operations from appearing unexpectedly.

  • Verify that request rate, error rate, and duration data appear.

  • Existing dashboards and detectors use the approved sf_workflow value.

See Configure Business Transaction rules.

Record the rule order, match criteria, target name, owner, validation traffic, and result.

Complete this task when every critical operation uses the approved workflow name or has an approved difference.