Getting Data In

How to Trigger Time is different than Notable time?

sarwshai
Communicator

I have Splunk on v9.0.1 and ES on v7.0.1, the issue am facing for the notable alerts is that some of the alerts have trigger time different than the notable time and the difference is vast in some cases, note that i've already checked timezone issues, there's none, all endpoints are in one same timezone.

This is messing up my SLA also it doesn't show up until few hours in the incident review tab, for e.g. the alert triggered at 3 PM,  but it won't show up until certain time and will have the notable time different, attaching snaps for reference, notice the time difference.

sarwshai_0-1688649766545.png

sarwshai_0-1688650222192.png

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...