Each of the notable events is generated either by a correlation search, multi-kpi alerts, grouping event or alert action. Each one of this carries different $result.fieldnames$.
For the correlation searches and multi-kpi alerts you can check the fields available and their names by executing the search that generated the notable event (Go to Configure -> Correlation Searches and copy the Search string defined).
Also you can check the fields avilable in both the itsi_tracked_alerts and itsi_grouped_alerts indexes. Both of then store the notable events generated by ITSI.
index=itsi_grouped_alerts OR index=itsi_tracked_alerts
Take a look at this search from the _internal index:
index=_internal sendemail sourcetype=itsi_internal_log
And you should see the search that ITSI is running. That will look something like this:
2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action]  Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$
Execute the generated search command and that will show you the fields that are available.