Here are the screenshots: In incident review setting, I have already labeled signature: Then in Correlation Search content setting, also I have setting the search query which could result in fields with signature. This search can be run normally in search head and show the result I want. But here related to drill-down search or description, this $signature$ can not show in notable of incident review:   May I ask how to solve this issue? ... View more