Not by lowering the fonts, but by using special unicode characters that look like ampersands but are not treated as ampersands. Try copying and pasting the ampersand-like characters from my post. ... View more

Hello sidoyle, Did you finally got an answer, we currently trying to do the same thing !  ... View more

I added the following to the end of the drill down and made sure the time range was at least the same as the notable run time: | eval drilldown_latest=_time + 3600 | eval drilldown_earliest=_time - 90000 you also need to make sure you have no mv fields  ... View more

I created a new "Security Domain" called Development, all my new rules have a notable that are then assigned to that until I am satisfied they are "in production" so to speak. Once they go in production i would put them into the relevant security domain. This can easily be identified in the Incident Review Dashboard.   Hope this helps. ... View more

I'm scratching my head over the same issue, i am new to Splunk and still finding my way around. Did you ever solve this problem ? ... View more