Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incident Review dashboard, though the search Time extractions does exists in the notable event
Example:-
My Notable Event Title Contains the following text
Suspicious activity detected from User $UserId$
Expected Output for Title in Incident Review Dashboard
Suspicious activity detected from User XYZ
How the Title Column gets displayed in Incident Review dashboard
Suspicious activity detected from User $UserId$
However, the extractions does work for built-in extractions or fields like sourcetype etc. Tokens work with few extractions, and not with few even though both of the search time extractions does exists in the notable events
We faced same and got fixed with ES 6.6.1 +hot fix splunk provided
Pls ensure the underlying correlation search returns a valid value for UserId, as this will be used in the Incident review screen.
Yes........... We do get valid result when we run the search (correlation search) in Splunk, only Incident Review dashboard does have challenge to expand the token values
Where in Incident Review dashboard, do you see the issue? In title, description, notable? Generally all these should work with $fieldname$. If its in the Incident review field values pane, then ensure the field is available as described in https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Customizenotables
Hope this helps.
The issue is seen within Tilte (rule_title) and Description fields of Incident Review dashboard... the notable event does have all the data expanded properly
What's your ES version and Splunk enterprise version.? I have n't seen this issue in ES 5.3.1, 6.x. You may also want to raise a case with support, if its only occurring on specific version.