Workflow Action: bug when filtering via flashtimeline

[marios_kstone]

Hello,

I found out a weird behavior that I managed to track down to a possible UI bug.

Issue: fields passed to workflow action do not match to the actual event that triggered the action.

Splunk version: 4.3, build 115073

How to reproduce:

• Define a workflow action to display for an event and associate the URI "http://www.google.com/search?q=$host$", get method.
• Perform a search returning several events linked to the workflow action
• filter out the events selecting a time slot in the flashtimeline applet
• start the workflow action on the first event listed after the filtering

Result:

The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search.

Anyone else can confirm this?

[cneberg]

Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks!