Knowledge Management

Workflow Action: bug when filtering via flashtimeline

Path Finder


I found out a weird behavior that I managed to track down to a possible UI bug.

Issue: fields passed to workflow action do not match to the actual event that triggered the action.

Splunk version: 4.3, build 115073

How to reproduce:

  • Define a workflow action to display for an event and associate the URI "$host$", get method.
  • Perform a search returning several events linked to the workflow action
  • filter out the events selecting a time slot in the flashtimeline applet
  • start the workflow action on the first event listed after the filtering


The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search.

Anyone else can confirm this?


Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks!

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!