We migrated Splunk ES from an old windows server to a new Linux server. Everything is good to go except we want to copy the old data from the incident_review kv store. It seemed simple to |inputlookup incident_review on the old search head and download that to a .csv (old_kv.csv), which could be uploaded to the new search head where |inputlookup old_kv.csv | outplutlookup incident_review append=t would merge the old data into the new kvstore. Seems pretty straight forward, but I don't know how the notables index is joined to the incident_review kv store in ES. Does anyone know if this would work? ... View more