when expanding aggregated event from inbox, limit to events in inbox

[inliniac]

When I click on the number indicating the number of events that are aggregated, I'm expecting to see only those events. In practice the search is based on sid+srcip+dstip, so it will contain archived events as well.

Perhaps only displaying events that are in the inbox would be better. Alternatively, maybe use a different color for the archived events.

[jasonish]

In this case the result set will now be limited to events that are in the inbox only. That was the intention in the first place.

Fixed with 82aeaf4