Knowledge Management

Workflow Action: bug when filtering via flashtimeline

Path Finder

Hello,

I found out a weird behavior that I managed to track down to a possible UI bug.

Issue: fields passed to workflow action do not match to the actual event that triggered the action.

Splunk version: 4.3, build 115073

How to reproduce:

  • Define a workflow action to display for an event and associate the URI "http://www.google.com/search?q=$host$", get method.
  • Perform a search returning several events linked to the workflow action
  • filter out the events selecting a time slot in the flashtimeline applet
  • start the workflow action on the first event listed after the filtering

Result:

The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search.

Anyone else can confirm this?

Explorer

Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks!

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!