Hi, es_notable_events is KVStore and it stores notable event information for last 48 hours, for more details what information stores in es_notable_events kvstore, have look at ESS - Notable Events scheduled search which runs at every 10 minutes, search last 48 hours data from notable macro, do some filtering and create field called timeDiff_type and assign value as current if notable generated in last 24 hours and assigns value as historical if notable generated between last 24 and last 48 hours and store that information with other fields in es_notable_events kvstore. ... View more