simpleLookup

A Workflow Engine function that defines the simple lookup as two arrays of equal length: keys and values. When the value of fromField matches a value in the keys array, sets toField to the value in the values array with the corresponding index.

This function is intended to make administration and usage easier, and is designed for short lists rather than for long lookups. For longer, more complex lookups, use the staticLookup function, which uses a configuration file.

This function is available as a feature of the Workflow Engine v1.2 download and later.

This function is available for event, alert, enrichment, and Situation workflows.

The workflow sweep up filter applies to this function.

Back to Workflow Engine Functions Reference.

Arguments

Workflow Engine function simpleLookup takes the following arguments:

Name

Required

Type

Description

fromField

Yes

String

Source field of the key.

keys

Yes

Object

Array of keys as a JSON array.

values

Yes

Object

Array of values as a JSON list.

toField

Yes

String

Destination field. Overwrites any existing values.

Example

The following example demonstrates typical use of Workflow Engine function simpleLookup, in which you perform a simple lookup that translates a textual severity in an event to a number-based severity.

Given this mapping of textual severity to it’s numeric equivalent:

"clear" : 0
"unknown" : 1
"warning" : 2
"minor" : 3
"major" : 4
"critical" : 5 

If you take your “key” from custom_info.sourceSeverity and put the looked up value into “severity”, set the following:

  • fromField: custom_info.sourceSeverity

  • keys: ["clear","unknown","warning","minor","major","critical"]

  • values: [0,1,2,3,4,5]

  • toField: severity

The UI translates your settings to the following JSON:

{
"fromField":"custom_info.sourceSeverity",
"keys":["clear","unknown","warning","minor","major","critical"],
"values":[0,1,2,3,4,5],
"toField":"severity"
}

The action returns true if the fromField value is found in the “keys” and the corresponding “value” was successfully set in toField.

The action returns false if the fromField has no value or was not found in the “keys” , the value was not successfully set, or if the “keys” and “values” are not of equal length.