I have Splunk on v9.0.1 and ES on v7.0.1, the issue am facing for the notable alerts is that some of the alerts have trigger time different than the notable time and the difference is vast in some cases, note that i've already checked timezone issues, there's none, all endpoints are in one same timezone.
This is messing up my SLA also it doesn't show up until few hours in the incident review tab, for e.g. the alert triggered at 3 PM, but it won't show up until certain time and will have the notable time different, attaching snaps for reference, notice the time difference.
