This Search can be used to check data correctly during search time: SPL:- index= <index_name> source=<source> host="<host>" sourcetype="XmlWinEventLog" | rex mode=sed field=_raw "s/&lt;/</g" | rex mode=sed field=_raw "s/&gt;/>/g" ... View more

As of ES 7.2, auto-refresh feature is available on Incident Review Page. Auto-refresh is paused when selecting or editing a Notable.  This will allow you to work the notable without refreshing the list.  You can manually re-load the IR Page and Auto-refresh is turned back on. See below KB for more details on how to enable it: https://docs.splunk.com/Documentation/ES/7.3.0/Admin/CustomizeIR#Configure_auto-refresh_to_update_notables  ... View more