under incident review settings table attributes enter notable_xref as the field and Short ID as the title Also you should schedule a search to run every 5 minutes */5 * * * * to automatically create the short id's, this is most helpful `notable` | where isnull(notable_xref) | eval notable_time=_time, xref_label="Short ID", xref_name="short_id", xref_id="V".substr(upper(md5(event_id)), 0, 5) | table event_id, notable_time, xref_id, xref_label, xref_name | outputlookup append=t notable_xref_lookup
... View more