I have a correlation search in which I use a simple eval command to create a new field (ex. eval test=123). This fields shows in the search, however, when I set this search as an alert, the eval field I created is missing on the notable event. How do I ensure that this custom field is being sent along with the other data that is sent by default as a notable event?
