https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Alerts-are-triggering-late/m-p/493125#M8439 <P>Hi,</P> <P>you might want to take a look into the <A href="https://splunkbase.splunk.com/app/2949/">Meta Woot</A> app to see whether you're having any indexing delays. The Monitoring Console might as well give you some good information about skipped searches. When some of your data has a ~60 minute lag, that could be a timezone issue which means your data probably isn't onboarded correctly. </P> <P>Skalli</P> Tue, 26 Nov 2019 09:24:40 GMT skalliger 2019-11-26T09:24:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Alerts-are-triggering-late/m-p/493124#M8438 <P>I have an alert with 'Notable' Alert action. <BR /> While checking the notable index i could see the notables triggered by the alerts are indexed after a delay (more than 60 mins).<BR /> Anyone faced the same issue? know the reason?<BR /> It is not happening for all the alerts though... Its happening only for some alerts , but all the time.. is there any specific configurations on these alerts which have a delay??</P> Mon, 25 Nov 2019 10:15:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Alerts-are-triggering-late/m-p/493124#M8438 harish_ka 2019-11-25T10:15:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Alerts-are-triggering-late/m-p/493125#M8439 <P>Hi,</P> <P>you might want to take a look into the <A href="https://splunkbase.splunk.com/app/2949/">Meta Woot</A> app to see whether you're having any indexing delays. The Monitoring Console might as well give you some good information about skipped searches. When some of your data has a ~60 minute lag, that could be a timezone issue which means your data probably isn't onboarded correctly. </P> <P>Skalli</P> Tue, 26 Nov 2019 09:24:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Notable-Alerts-are-triggering-late/m-p/493125#M8439 skalliger 2019-11-26T09:24:40Z