Splunk Enterprise Security: Why won't a workflow action open in a new search from the Incident Review page?

[chiltonb]

I have made a workflow action item that looks up details on an IP address when there is a threat hit. This works when it is ran from the Search and Reporting app, but when I try to run it from the Incident Review page within Splunk Enterprise Security (ES) it defaults back to ES and does not open it in a new search. Does anyone know why this won't allow me to open in a new search?

[jstoner_splunk · Accepted solution]

If I read this correctly, you are in IR, you build your own field menu workflow and you want to run a search. You put in a search string that worked correctly before. You are running in the current app context which should be ok.

What view are you using? It is not a mandatory field but when doing an integration of my own, I setting the view field to search and then opened a new window would work decently.

[jstoner_splunk]

[chiltonb]

That worked, I didn't type search in the "Open in view" box, I thought that it would have been a drop down selection.

Thanks!

[chiltonb]

Correct im in Incident Review, I then go to actions and then to the workflow I have created. The work flow is set to open in a new window.