When we create the correlated searches, how do we specify which fields will be visible in the notable event / incident?
That is covered in the docs. Incident Review Settings. https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Customizenotables
@starcher, after adding it according to the instructions, we don't see the field under -
What can it be?
