Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incident

[VasukiPramod]

Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incident Review dashboard, though the search Time extractions does exists in the notable event

Example:-

My Notable Event Title Contains the following text

Suspicious activity detected from User $UserId$

Expected Output for Title in Incident Review Dashboard

Suspicious activity detected from User XYZ

How the Title Column gets displayed in Incident Review dashboard

Suspicious activity detected from User $UserId$

However, the extractions does work for built-in extractions or fields like sourcetype etc.  Tokens work with few extractions, and not with few even though both of the search time extractions does exists in the notable events

[SONY_anilyelmar]

We faced same and got fixed with ES 6.6.1 +hot fix splunk provided

[lakshman239]

Pls ensure the underlying correlation search returns a valid value for UserId, as this will be used in the Incident review screen.

[VasukiPramod]

Yes........... We do get valid result when we run the search (correlation search) in Splunk, only Incident Review dashboard does have challenge to expand the token values

[lakshman239]

Where in Incident Review dashboard, do you see the issue? In title, description, notable?  Generally all these should work with $fieldname$.  If its in the Incident review field values pane, then ensure the field is available as described in https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Customizenotables 

Hope this helps.

[VasukiPramod]

The issue is seen within Tilte (rule_title) and Description fields of Incident Review dashboard... the notable event does have all the data expanded properly

[lakshman239]

What's your ES version and Splunk enterprise version.? I have n't seen this issue in ES 5.3.1, 6.x. You may also want to raise a case with support, if its only occurring on specific version.