Splunk Enterprise Security: How to become adept at correlation searches and notable events?

[test_qweqwe]

Hello, I have already written similar questions in past, but now it's global issue.
Official documentation not answer to all my questions.

So, let's start!
For example, when I wrote my custom correlation search and created notable event.
Many times it's looks like this or like this.

How me make it look nice and informative?

[mdessus_splunk]

Hi, you need to have the relevant fields as output of your rule. For example if your look to some rules in ES, you might find things like this:

... | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" ...

Feel free to post the search you're working on if you need more details.