Event Workflow Actions
You can include any of the following actions in an event workflow. Each action updates one event and then passes it to the next action.
Workflow trigger — Every workflow starts with a trigger, which defines the events that trigger the workflow.
Drop Event action — Drop events that pass a previous filter in the workflow, such as a Time Filter.
Extract Substring action — Extract a string from an input field using a regex and then apply the result to one or more output fields.
Match and Update action — Search for a set of strings in a set of fields, then update a field based on the results. This is useful for normalizing events with different formats.
Query Catalog action — Enrich your events by mapping data from a catalog to new events.
Parse FQDN action — Parse a field with an FQDN and then copy the hostname and domain name to other fields.
Replace String action — Replace a field with a new string.
Set Service action — Update the
servicefield if an event passes a previous filter.Set Severity action — Update the
severityfield if an event passes a previous filter.Split action — Split one field into substrings based on a character pattern and then copy the substrings to other fields.
Template Field Action — Update a field based on the values of other fields.
Time Filter Action —Filter events based on a specific time window or day of the week.