A POST workflow action in Splunk is designed to send data to an external web service by using HTTP POST requests. This type of workflow action can pass a combination of clear text strings and variables derived from the search results or event data. The clear text strings might include static text or predefined values, while the variables are dynamic elements that represent specific fields or values extracted from the Splunk events. This flexibility allows for constructing detailed and context-specific requests to external systems, enabling various integration and automation scenarios. The POST request can include both types of data, making it versatile for different use cases.

The transaction command is a Splunk command that finds transactions based on events that meet various constraints1.
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member1.
The transaction command adds some fields to the raw events that are part of the transaction12. These fields are:
duration: The difference, in seconds, between the timestamps for the first and last events in the transaction12.
eventcount: The number of events in the transaction12.
closed_txn: A Boolean field that indicates whether the transaction is closed or evicted2. A transaction is closed if it meets one of the following conditions: maxevents, maxpause, maxspan, or startswith2. A transaction is evicted if it does not meet any of these conditions and exceeds the memory limit specified by maxopentxn or maxopenevents23.
Therefore, evicted transactions can be distinguished from non-evicted transactions by checking the value of the closed_txn field. The closed_txn field is set to 0, or false, for evicted transactions and 1, or true for non-evicted, or closed, transactions23.

The CIM Add-on manual contains the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on, as well as how to set up, use, and customize the add-on.
Reference
CIM Add-on manual
Splunk Common Information Model (CIM) | Splunkbase
Understand and use the Common Information Model Add-on - Splunk

Reference:
The Field Extractor (FX) is a tool that helps you extract fields from your data using delimiters or regular expressions. Delimiters are characters or strings that separate fields in your data. The FX can detect some common delimiters automatically, such as pipes (|), spaces ( ), commas (,), semicolons (;), etc. The FX cannot detect tabs (\t) as delimiters automatically, but you can specify them manually in the FX interface.

Reference:
https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Separate-on-Colon/m-p/29751 The Field Extractor (FX) is a tool that helps you extract fields from your data using delimiters or regular expressions. Delimiters are characters or strings that separate fields in your data. Some of the delimiters that will work with FX are:
Tabs: horizontal spaces that align text in columns.
Pipes: vertical bars that often indicate logical OR operations.
Spaces: blank characters that separate words or symbols.
Therefore, the delimiters A, B, and D will work with FX.