Log ingestion delay

[tsa]

We are observing delayed ingestion of logs from neuvector application, via syslog method

[splunkreal]

Hello @tsa which sourcetype did you set? It doesn't look documented at https://open-docs.neuvector.com/integration/splunk/

Something like neuvector:json?

Thanks!

[PickleRick]

Is the delay consistent?

What did you troubleshoot so far? Did you check whether the data which is being received on the syslog receiver (whatever you use) is "current"? Does the source have properly set time? Does your syslog receiver have properly set time? Do you have proper time parsing configuration?

[vjdev]

Hello,

Confirm the below,

1. No issues  with Network bandwidth [QOS]
2. Splunk Syslog/Syslog-NG/rsyslog which one are you using?
3. View the data with packet capturing, monitor the timestamp in the data.