Splunk Enterprise Security 8.x Analyst Queue Page Slow to Load

Applicability

Description

Experiencing severe performance degradation when loading the Analyst Queue in Splunk Enterprise Security (ES) v8. This is impacting SOC analyst triage and operational efficiency.

Investigation

The issue is most pronounced when clicking Notable Event URLs from ServiceNow, which triggers an "All time" search that takes a significant amount of time to load. When using the default setting 7 days in the page to search, it took seconds to load the result.

Resolution

In the Notable Event URL from ServiceNow, it includes earliest=0 which is for "All time" range. Once changing it to earliest=-7d, the page was loaded within seconds. As a workaround, you can manually change All Time search range to Last 7 days. Ideally, a permanent solution is to modify the earliest parameter in URL from ServiceNow to automate the time range to default 7 days.