I am trying to include dynamic names for a notable event that I have triggering. When I try to use $variable$ it just shows that and does not pull the field value.
My search:
index = o365 sourcetype="mscs:azure:eventhub" body.operationName="User Risk Detection" "body.properties.riskLevel"=high
| rename body.properties.userDisplayName AS "Display Name"
My Name:
Office 365 Risky User Detected - $Display Name$
Can anyone help?
