I have a query related to drilldown searches of notables. I want to export/show results of drilldown searches with variables substituted corresponding to each notable.
Example, consider following search:`notable` | search event_id="XXXXXX" | table drilldown_search,drilldown_earliest,drilldown_latest
The above search will give me drilldown search but with variables not substituted. I want the variables to be substituted in the search results.
Actual result of above search - index=abc action=failure user="$user$"
Desired output - index=abc action=failure user="firstname.lastname@example.org"
Let me know if any further info is needed. Thanks in advance.