I'd like to search the status of Incident Review, and have found 2 ways to do it.
1)| inputlookup append=T es_notable_events
2)| inputlookup append=T incident_review_lookup
Other than above 2 ways, many person may look to use "|incident_review
" for that.
Maybe "|incident_review
" contains 2)| inputlookup append=T incident_review_lookup.
Ideally, I want to display detail information like rule_title,src,user etc.
So I guess 1)| inputlookup append=T es_notable_events is better.
However I'd like to know the differences between "es_notable_events" and "incident_review_lookup".
Best Regards,
Your best would be to use the notable macro and get required fields, `notable
| fields rule_title, search_name`