under incident review settings table attributes enter   notable_xref  as the field and Short ID as the title   Also you should schedule a search to run every  5 minutes  */5 * * * * to automatically create the short id's, this is most helpful  `notable` | where isnull(notable_xref) | eval notable_time=_time, xref_label="Short ID", xref_name="short_id", xref_id="V".substr(upper(md5(event_id)), 0, 5) | table event_id, notable_time, xref_id, xref_label, xref_name | outputlookup append=t notable_xref_lookup ... View more