Hi Team,
I have a query related to drilldown searches of notables. I want to export/show results of drilldown searches with variables substituted corresponding to each notable.
Example, consider following search:
`notable` | search event_id="XXXXXX" | table drilldown_search,drilldown_earliest,drilldown_latest
The above search will give me drilldown search but with variables not substituted. I want the variables to be substituted in the search results.
Actual result of above search - index=abc action=failure user="$user$"
Desired output - index=abc action=failure user="johndoe@example.com"
Let me know if any further info is needed. Thanks in advance.
Regards,
Shaquib
