Splunk Event Profile _time is not matching with Time of event in SIR incident when both are mappedIssue Splunk Event Profile _time is not matching with Time of event in SIR incident when both are mapped, there is difference between _time(Source) and time of event (Target)ReleaseAllCauseIn certain cases, event field values in the Splunk Enterprise notable events may not translate directly to the fields on the SIR security incident. For these values, you can use a script editor to format field values on the security incident during the mapping step. Use the script editor if you want to format values that are similar, but not identical https://docs.servicenow.com/csh?topicname=splunk-event-ingest-create-profile-security.html&version=latest#splunk-map-alerts-securityResolution* If the Time is not matching to Splunk event field and SIR incident field we can use below script to match the Source and Destination fields, you can use directly as Source and destination fields in script since those are already defined in back end. var gd = new GlideDateTime();gd.setValueUTC(sourceValue, "yyyy-MM-dd'T'HH:mm:ss.SSSX");destinationValue = gd.getDisplayValue();* even though we use above script we will see an error as "illegal access to method setValueUTC(string, string) in class com.glide.glideobject.GlideDateTime"* so to avoid this issue we have set the withEnforcedSecurity to false in script include GlideScopedEvaluator "SplunkFieldMapProcessor" in line 380* Please take a look at the screen shot where to find script editor