Hi, the way I understand your question is that you are looking for the configuration file with the definition of the source and the sourcetype for the events in the notable index of ES. The answer to that question is: There are none. The notable index is being populated through correlation searches that end in a ...| collect ... command that writes the result of the correlation search to the notable index. See this page for more information on how to use collect to write data to an index: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2008/SearchReference/Collect
