- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi everyone,
I am creating a workflow action that allows me to links to a website (e.g. google.com) from Incident Review dashboard. The problem is, in order to use the workflow action, I need to pass a field that is available from a lookup file (based on event_id). May I know how to do lookup for the notable events?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable
macro... that macro makes sure the event_id
is computed, and therefore your lookup can only be added afterwards.
Then you can use the lookup's output fields in your workflow action as usual.
Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable
macro... that macro makes sure the event_id
is computed, and therefore your lookup can only be added afterwards.
Then you can use the lookup's output fields in your workflow action as usual.
Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah I see..thanks for the detailed explanations!
