We recently had an issue with the Splunk scheduler wherein correlation searches weren't running (fixed by simply restarting the SHC members). Due to this, we've lost Notable events. I thought I could backfill these using the fill_summary_index.py script however it seems this may not be correct? I'm able to successfully kick off "back filling" correlation searches however I'm not seeing any Notable events added to the notable index. splunk cmd fill_summary_index.py -app <app> -name <search> -et <start epoch> -lt <end epoch> -dedup true -nolocal true -j 4 (for example) Can someone please confirm or deny this? ... View more