I found out a weird behavior that I managed to track down to a possible UI bug.
Issue: fields passed to workflow action do not match to the actual event that triggered the action.
Splunk version: 4.3, build 115073
How to reproduce:
The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search.
Anyone else can confirm this?
Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks!