What's the step between correlation searches and episode reviews?

[keesling]

I've "Opened in Search" one of my episode review searches, then typed ctrl-shift-e to view the "expanded search string".  Doing this, I found that the event count, along with other data, was obtained via lookup on itsi_notable_group_system_lookup (among other itsi tables).  I then expanded the search string for one of my notable event searches, but find no indication that this search writes to those tables.  What step(s) am I missing between the notable event search and the episode review search?  I'm trying to determine how the episode grouping is done, which appears to happen between the NE search and the episode review search.

[esnyder_splunk]

@keesling can you take a look at the following resources and see if they answer your question? 

• https://docs.splunk.com/Documentation/ITSI/4.6.1/EA/AboutEA
• https://docs.splunk.com/Documentation/ITSI/4.6.1/EA/RE

CC @eduncan if you have any other knowledge to impart.