My solution was go into the "All Fields" button on the left of the search results, change Coverage: From "All fields", to something smaller, and hit deselect all. Then run a simple search to make sure things are coming up, then go back and select just specific fields and everything starts to work. My best guess is that at some point - I had it select a huge number of fields, and doing these changes forces it to forget the huge list which fixes the issue. ... View more

My solution was go into the "All Fields" button on the left of the search results, change Coverage: From "All fields", to something smaller, and hit deselect all. Then run a simple search to make sure things are coming up, then go back and select just specific fields and everything starts to work. My best guess is that at some point - I had it select a huge number of fields, and doing these changes forces it to forget the huge list which fixes the issue. ... View more

Yes - I can confirm the values sent to the worflow action are incorrect (I'm not sure of where they come from) and finding your research in google saved me a lot of time. Thanks! ... View more

If you are just going to copy the distutils directory from another installation of python, make sure it is the same sub-sub-version of python as well 2.6.4 vs 2.6.5, etc. It was easier to build a new copy of python on the same system of the exact same version as the splunk version, then do builds of python modules there. Then copy the generated shared libraries and .py files into the splunk version of python in the equivalent locations. ... View more