Delays/ Latency seen in creation of security incidents from the time the status of an investigation is changed in Splunk ESIssue Some latency has been observed on the creation of security incidents in ServiceNow, from the time the status of an investigation is changed in Splunk ES to secure place and the time when a SIR is created in SN. In some cases it takes more than 6 mins for a SIR to be created.Average search time of the search submitted by ServiceNow to Splunk to find events has been 6.73 seconds. Average latency of the job to fetch the results has been 62 seconds - max of 244 seconds. Latency is measured by the difference between the time the results were fetched and the time of the job that produced them. Timings are comfortably within the results expiry time of 600 seconds. The following should be happening:1. Splunk ES runs correlation searches (scheduled)2. A notable event is created3. Every minute ServiceNow sends a search to Splunk requesting the alerts (notable event)4. ServiceNow follows up with a request for the alert data (the results of the search from the previous step)5. ServiceNow does its part (including creating the SIR)6. Sends a request back to Splunk to update the alert with the SIR and URLThe timing issues we are seeing are occurring between step 3 & 4 above. We are not sure what ServiceNow does between these steps ? We have some examples provided by our Splunk Team with timings from 28/4/26:Created from 19:00 on the 28/04 through to 29/04:https://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/2f58bdd2-5dfc-409f-8e5f-35adb1ccf8e7/overview?earliest=-24h%40h&latest=now - 5minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/47809da1-532e-4d59-9ccf-1e231ed73880/overview?earliest=-24h%40h&latest=now - 5minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/12fd9168-90f6-4027-80c7-452b73673b2b/overview?earliest=-24h%40h&latest=now - 4minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/7563c9f2-6859-4e36-b57a-8d39553a1eec/overview?earliest=-24h%40h&latest=now - 3minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/f857f91b-fe01-4374-b089-e111a35662b9/overview?earliest=-24h%40h&latest=now - 2minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/a080893c-3b32-4567-bd85-eaa41148da35/overview?earliest=-24h%40h&latest=now - 3minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/98df54c2-4636-480b-9bc6-205b0db7cb65/overview?earliest=-24h%40h&latest=now - 5minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/befc1237-5b2a-4959-9c34-08c8c9ab60c3/overview?earliest=-24h%40h&latest=now - 2minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/8655daac-8b4a-4bed-a7cd-c5a334dae48e/overview?earliest=-24h%40h&latest=now - 4minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/3cd01451-62f2-4b58-9e8d-96e0b58522a2/overview?earliest=-24h%40h&latest=now - 7minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/e6b55647-0c6c-4149-9d6d-cdd3d2eb4e87/overview?earliest=-24h%40h&latest=now - 5minshttps://xxx.splunkcloud.com/en-GB/app/SplunkEnterpriseSecuritySuite/incident_review#/b1ee2d99-502c-4617-97b4-11ef68aeb326/overview?earliest=-24h%40h&latest=now -1minsHave reviewed recommended: KB0862536 ("Splunk ES Integration for Security Operations" Integration, Security Incidents are not Being Created in the SN Instances as Expected) but this seem to relate to versions 10.4.0 and below.We are currently on version 12.1.10 of Splunk ES Integration for Security OperationsPlease could you advise if these timings we are seeing are 'normal' as we have no previous timings/ data to compare it to ? Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The primary cause of this delay appears to be the overlap setting, which is currently configured for 7 days. With this configuration, the integration attempts to retrieve seven days' worth of historical data during each polling cycle. This is an unusually large overlap window and results in the repeated retrieval of duplicate historical data, significantly increasing the processing time. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Our analysis shows that the polling for SID: 1781798072.3300574_DE30780D-0F44-4611-A3AE-EF2C1D41A048 occurred at 16:54 on 18-June, while the corresponding raw data was retrieved from Splunk at 17:05, resulting in an approximately 11-minute delay.The primary cause of this delay appears to be the overlap setting, which is currently configured for 7 days. With this configuration, the integration attempts to retrieve seven days' worth of historical data during each polling cycle. This is an unusually large overlap window and results in the repeated retrieval of duplicate historical data, significantly increasing the processing time.Our recommendation is to reduce the overlap setting in the Splunk ES integration to 5–10 minutes. After making this change, please monitor the integration for a few days and verify whether the delay persists.https://xxx.service-now.com/system_properties_ui.do?sysparm_title=Splunk%20ES%20Settings&sysparm_category=Splunk%20ES%20Integration&sysparm_use_polaris=false