My expectation is that you're comparing different things. I have no idea regarding how do you calculate timeTaken and feed it to Splunk, however I think the following happens:
- JMeter sends a request
- Here JMeter measurement begins
- Request travels to the application under test
- Application under test dispatches it to the relevant endpoint
- Here your measurement begins
- Application under test processes the request and prepares the response
- Here your measurement ends
- Application server sends the response back to JMeter
- JMeter measures time to first byte
10 JMeter measures time to last byte
So in Splunk you have only timing for point 6 and JMeter reflects timings for the whole sequence including the time to travel back and forth (check out Connect Time and Latency metrics).
According to JMeter Glossary
Elapsed Time = Connect Time + Latency
So you need to subtract Connect Time from what you see in Splunk and the result should be closer.