Replace Notable Title Variable With Value

[Devinz]

I need to replace the variables in the field rule_title field that is generated when using the `notable` macro. 

Devinz_0-1729805950375.png

I was able to get this search to work but it only works when I table the specific variable fields. Is there a way I can do that but for all title regardless of title and variable fields? 

Devinz_1-1729806221272.png

[gcusello]

Hi @Devinz ,

as all the tokens in Splunk, the field to pass as token to the Correlation Search Title must be in the results of the Correlation Search itself, so, in your first example you would use the $description$ field bu you don't have this field after the stats count BY rule_title command.

You have to add to your CS the fields to display in the title.

Ciao.

Giuseppe