https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/759442#M12868 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/313187">@tsa</a>&nbsp;which sourcetype did you set? It doesn't look documented at&nbsp;<A href="https://open-docs.neuvector.com/integration/splunk/" target="_blank">https://open-docs.neuvector.com/integration/splunk/</A></P><P>Something like neuvector:json?</P><P>Thanks!</P> Thu, 19 Mar 2026 15:03:13 GMT splunkreal 2026-03-19T15:03:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/753478#M12682 <P>We are observing delayed ingestion of logs from neuvector application, via syslog method</P><P>&nbsp;</P> Tue, 23 Sep 2025 05:30:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/753478#M12682 tsa 2025-09-23T05:30:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/753714#M12688 <P>Hello,</P><P>&nbsp;</P><P>Confirm the below,</P><P>&nbsp;</P><P>1. No issues&nbsp; with Network bandwidth [QOS]<BR />2. Splunk Syslog/Syslog-NG/rsyslog which one are you using?<BR />3. View the data with packet capturing, monitor the timestamp in the data.</P><P>&nbsp;</P> Sun, 28 Sep 2025 12:09:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/753714#M12688 vjdev 2025-09-28T12:09:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/753717#M12689 <P>Is the delay consistent?</P><P>What did you troubleshoot so far? Did you check whether the data which is being received on the syslog receiver (whatever you use) is "current"? Does the source have properly set time? Does your syslog receiver have properly set time? Do you have proper time parsing configuration?</P> Sun, 28 Sep 2025 14:36:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/753717#M12689 PickleRick 2025-09-28T14:36:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/759442#M12868 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/313187">@tsa</a>&nbsp;which sourcetype did you set? It doesn't look documented at&nbsp;<A href="https://open-docs.neuvector.com/integration/splunk/" target="_blank">https://open-docs.neuvector.com/integration/splunk/</A></P><P>Something like neuvector:json?</P><P>Thanks!</P> Thu, 19 Mar 2026 15:03:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Log-ingestion-delay/m-p/759442#M12868 splunkreal 2026-03-19T15:03:13Z