Knowledge Management

Workflow Action: bug when filtering via flashtimeline

Path Finder


I found out a weird behavior that I managed to track down to a possible UI bug.

Issue: fields passed to workflow action do not match to the actual event that triggered the action.

Splunk version: 4.3, build 115073

How to reproduce:

  • Define a workflow action to display for an event and associate the URI "$host$", get method.
  • Perform a search returning several events linked to the workflow action
  • filter out the events selecting a time slot in the flashtimeline applet
  • start the workflow action on the first event listed after the filtering


The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search.

Anyone else can confirm this?


Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks!

Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...