Security

Splunk Enterprise notables generated after 10hours

rsawant2085
Engager

Hello, In splunk Enterprise Has anyone experienced cases where notable events are generated after 10+hrs the trigger time?
scenario is - I have created correlation searches which runs every 10mins . for adaptive responses i have configured email alert and notable. Although email alerts get triggered properly as per schedule but the notables are getting generated 10-12hrs past the alert triggered time.
Can anyone suggest on how to proceed on troubleshooting this ?

Labels (1)
0 Karma
1 Solution

rsawant2085
Engager

figured out the issue. the _time field was converted to string value which caused the notable to be generated at GMT time rather than sydney time .
removed the string convertion 

View solution in original post

0 Karma

rsawant2085
Engager

figured out the issue. the _time field was converted to string value which caused the notable to be generated at GMT time rather than sydney time .
removed the string convertion 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...