I am trying to assign custom tags to notable events so that they can be triaged by certain analysts, i.e., tier 1. I have a cron scheduled search created and it is set to create notable events; this works fine. I then setup a corresponding tag for that search_name but when I try to filter by the tag name in the tag field in the Incident Review dashboard it does not show up.
scheduled search (search name is triagetest) that is working and generates a notable: index=snort signature="test rule"
tag (tag name is usecasetest) that is not working: `searchname=triagetest`