How do I update the bidirectional ticketing correlation search time range?

Applicability

Description

The bidirectional ticketing correlation search runs on a schedule and searches for recent ticket updates. The search uses a macro to define how far back in time it searches.

The macro time range must cover the full period since the previous scheduled search run.

For example, when the correlation search runs every five minutes, it must search at least the previous five minutes. A small additional buffer is recommended to allow for delayed search starts, indexing delays, and ticket-update processing time.

If the macro time range is too short, some ticket updates are outside the search window and are not processed.

A possible symptom is that a resolved ServiceNow incident does not update the related Splunk IT Service Intelligence episode. Other ticket updates may also be missed.

No specific error message is required for this issue. The issue is visible in the correlation search configuration and search results.

Investigation

Review both settings:

1. The schedule interval for the bidirectional ticketing correlation search.
2. The time range in the macro used by that search.

Compare the values in seconds.

The macro time range must not be shorter than the correlation search interval.

The following configuration creates a coverage gap:

With this configuration, the search runs every 300 seconds but searches only the previous 90 seconds. Ticket updates received during the remaining 210 seconds are outside the search window.

To confirm the configuration issue:

1. Open the configuration for the bidirectional ticketing correlation search.
2. Record its scheduled interval.
3. Review the macro called by the search.
4. Identify the earliest time, time range, or look-back value in the macro definition.
5. Confirm that the macro time range is equal to or greater than the scheduled interval.
6. Review search results for expected ticket updates during the full scheduled interval.

Resolution

Update the macro time range when changing the bidirectional ticketing correlation search schedule.

1. Determine the correlation search schedule interval in seconds.
2. Add a small processing buffer, such as 30 seconds.
3. Update the macro time range to use the calculated value.
4. Save the macro and correlation search configuration.
5. Confirm that scheduled searches complete successfully.
6. Validate that ticket updates are returned during the full interval between search runs.

Use the following calculation:

Macro time range = correlation search schedule interval + processing buffer

Example:

Correlation search schedule: 5 minutes = 300 seconds
Processing buffer: 30 seconds
Macro time range: 330 seconds

Use a larger buffer when the environment has known indexing delays, delayed ServiceNow updates, or long search runtimes.