Knowledge Management
Highlighted

Workflow Action: bug when filtering via flashtimeline

Path Finder

Hello,

I found out a weird behavior that I managed to track down to a possible UI bug.

Issue: fields passed to workflow action do not match to the actual event that triggered the action.

Splunk version: 4.3, build 115073

How to reproduce:

  • Define a workflow action to display for an event and associate the URI "http://www.google.com/search?q=$host$", get method.
  • Perform a search returning several events linked to the workflow action
  • filter out the events selecting a time slot in the flashtimeline applet
  • start the workflow action on the first event listed after the filtering

Result:

The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search.

Anyone else can confirm this?

Highlighted

Re: Workflow Action: bug when filtering via flashtimeline

Explorer

Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks!