FYI, I resolved this in my own Splunk deployment. In $SPLUNK_HOME/etc/apps/$WINDOWS_ADDON/local/inputs.conf I had quotes around our domain name for evt_dc_name. I removed them, the problem went away, and our wineventlog:security events stopped being delayed. This behavior began after upgrading our deployment to 6.0.2.
... View more