https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-variable-names-in-notable-events/m-p/605181#M10913 <P>I am trying to include dynamic names for a notable event that I have triggering. When I try to use $variable$ it just shows that and does not pull the field value.</P> <P>My search:</P> <P>index = o365 sourcetype="mscs:azure:eventhub" body.operationName="User Risk Detection" "body.properties.riskLevel"=high<BR />| rename body.properties.userDisplayName AS "Display Name"</P> <P>&nbsp;</P> <P>My Name:</P> <P>Office 365 Risky User Detected - $Display Name$</P> <P>Can anyone help?</P> <P>&nbsp;</P> Mon, 11 Jul 2022 16:47:32 GMT mdicenzo 2022-07-11T16:47:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-variable-names-in-notable-events/m-p/605181#M10913 <P>I am trying to include dynamic names for a notable event that I have triggering. When I try to use $variable$ it just shows that and does not pull the field value.</P> <P>My search:</P> <P>index = o365 sourcetype="mscs:azure:eventhub" body.operationName="User Risk Detection" "body.properties.riskLevel"=high<BR />| rename body.properties.userDisplayName AS "Display Name"</P> <P>&nbsp;</P> <P>My Name:</P> <P>Office 365 Risky User Detected - $Display Name$</P> <P>Can anyone help?</P> <P>&nbsp;</P> Mon, 11 Jul 2022 16:47:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-variable-names-in-notable-events/m-p/605181#M10913 mdicenzo 2022-07-11T16:47:32Z