Hi @kn450 , @Saba    I have encountered this same issue a few days back and solved it by running a playbook to do a splunk search to create the event_id from the data in my artifact. The macro `get_event_id_meval` is used to create the event id from the indexer_guid, index and event_hash fields, separated by "@@", i.e. indexer_guid@@index@@event_hash. Is this the best way? Probably not, but it does work and I can always update it should I find a better solution. See the search below. index=notable search_name="<your_search_name>" firstTime="xxxx" lastTime="xxxx" | eval `get_event_id_meval` | fields event_id   ... View more