Splunk Search

How does Splunk calculate Time to Triage?

-Chris-
Observer

How does Splunk calculate Time to Triage, what data does it use? e.g. time an event occurred and time the event was put modified or put in pending etc.?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @-Chris-,

it isn't so clear for me what you mean with "Time to triage"

if you mean the time that Splunk need to index a log, it's very low and depends on the time requested to transfer data from Universal Forwarder to Indexer, then it depends on the queue that you can monitor using the Monitor Console.

It's possible to modify data only before indexing, during the parsing phase, after data are uneditable, and they are pending only if there are queues that you can see using the Monitor Console.

Ciao.

Giuseppe

0 Karma

-Chris-
Observer

Example: https://community.splunk.com/t5/Splunk-Search/Mean-Time-To-Triage/m-p/568484

This is specifically related to Splunk ES and Notable Events (NE). We assume that TTT is the time that an NE fires how long until it is next modified, e.g. the status is changed. We want to confirm this.

0 Karma

-Chris-
Observer

More investigation looks like it uses a field called "duration"? But we can't see how it is calculated or what process steps influence the duration. i.e update timestamps.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...