Getting Data In

Trigger time is Populate different in incident review tab

sahiltcs1
Loves-to-Learn

We have created two use cases and set up correlation search, Trigger time is every 10 minutes.

When notable event generate in incident review tab, What we observer there is fluctuation in time, trigger time and notable event time are different.

Please refer below screenshot for time difference highlighted.

Trigger time:

1/6/21 4:06:45.000 AM
Audit
User Account x was Locked out by Host
 

 

Adaptive Responses: 
Response Mode Time User Status
Notablesaved2021-01-05T17:12:35+1100  success

 

Need to understand why there is time difference?

 

Thanks,

Sahil

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

The only think I can suggest is there may be a wrong timestamped event on EventID=4725 or 4722. Since you are using "latest(_time) as _time" it will try to get the latest event sorted by _time. Please check if the correlation search that creates mismatched times has wrong timestamped data. You should be see this by running these searches and checking _time field.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

If you can share your correlation search maybe we can investigate better.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sahiltcs1
Loves-to-Learn

first one-

| tstats summariesonly=f allow_old_summaries=t count latest(_time) as _time from datamodel="Change"
where All_Changes.result_id=4725 by All_Changes.dest All_Changes.action All_Changes.result All_Changes.user All_Changes.Account_Management.src_user
| rename All_Changes.* as * , Account_Management.* as * | convert timeformat="%Y/%m/%d %T" ctime(_time) as _time

 

2nd one-

| tstats summariesonly=f allow_old_summaries=t count latest(_time) as _time from datamodel="Change"
where All_Changes.result_id=4722 by All_Changes.dest All_Changes.action All_Changes.result All_Changes.user All_Changes.Account_Management.src_user
| rename All_Changes.* as * , Account_Management.* as * | convert timeformat="%Y/%m/%d %T" ctime(_time) as _time

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sahiltcs1,

On your sample Trigger time and Notable times are shown in different time zones. I assume your question is this  ~6 minutes delay on notable event time.

Since you are running correlation search on every 10 minutes, I assume your time range is something like -10m@m . Incident Review tab shows the actual event time that caused that notable. But notable time is the time that your correlation search finalizes by finding a result.

That is why it is normal that this time can be 0 to 10m before the notable event creation time.  

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sahiltcs1
Loves-to-Learn

I don't think so its time zone issue, because other use cases we set up same condition and and in that use case we can see same time  there is no delay, But for this use case we are facing this issues

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...