When you get an incident in splunk-ES, the notable is often populated with 'additional fields'. some of these custom, some out of the box. Im looking to see what fields would be displayed for a notable from either searching the notable macro or the api if need be. searching the notable macro, I often i get 100+ fields for a notable, but maybe only 15 are displayed in the notable itself, where some other notable may only have 5 displayed. Is there a way to do a search that indicates wich fields would be displayed in the 'additional fields' of the notable?
for reference the additional fields im talking about are mentioned here under 'Add a field to the notable event details': https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Customizenotables
