Splunk Community

Find answers, ask questions, and connect with our community of consumers and specialists.

122K Members 1,511 Online 157K Posts

Join us for a 4-part series on Splunk Agent Observability consisting of Webinar, Tech Talk, Workshop, and Office Hours

Getting Started

Learn more about the Splunk Community and how we can help

Community Blog

Community happenings, product announcements, and Splunk news

Learning Paths

Discover Community and Learning Resources for your Role

User Groups

Meet up with other Splunk practitioners, virtually or in-person

Meet the SplunkTrust

"Being a member of SplunkTrust as well as a User Group Leader enriches my knowledge of Splunk greatly. I am exposed to and learn so much about Splunk that I can be on top of any new features well ahead of the game." - Becky Burwell

The SplunkTrust is comprised of our most dedicated community members. They assist other members, participate in events, demonstrate the power of Splunk's products, and help guide future roadmaps.

Learn more

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security are no strangers to alert fatigue. A high-severity notable fires, and an analyst ...

Loves-to-Learn

on Community Blog Friday

1131

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed with learning. But when the breakout rooms clear, it’s time to step away, grab a drink, and ...

Community Manager

on Community Blog Thursday

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent Launchpad to build an AI-powered workflow addressing a real-world Splunk challenge. And ...

Splunk Employee

on Community Blog Wednesday

151

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in Splunk Cloud Platform becomes complex quickly, as an average stack of about 50 applications ...

Splunk Employee

on Splunk Tech Talks Wednesday

139

Splunk Search Please I need help fixing this search below. Will appreciate the help. When I run the search I don't see the results... by USA69 Path Finder in Splunk Enterprise 3 hours ago 0 6	0	6
KV Store startup failure: Failed to import PFX file into Keychain I just upgraded Splunk to 10.4 (10.2.2 x86_64 to 10.4 arm64) on macOS, and the previously working KVStore now does no... by i0ntempest Loves-to-Learn Lots in Deployment Architecture 4 hours ago 0 9	0	9
How to view data from Threat intel collections? Hello, Like any other ES user, we have threat intel feeds configured that came along with box. How can i view the ac... by neerajs_81 Builder in Splunk Enterprise Security 9 hours ago 0 2	0	2
The Search shows different results from what the dashboard is showing. They should be the same Can someone help me optimize this search so the results on the search and dashboard panel should be the same. The sea... by USA69 Path Finder in Splunk Search 11 hours ago 0 7	0	7
Where can I download my Splunk certifications? I recently passed the tests for the Splunk Power User and Splunk Admin certifications. I got emails from Splunk sayi... by natebolt01 Engager in Training + Certification Discussions 12 hours ago 3 10	3	10
Documentation clarity (Python for Scientific Computing) Some feedback on this TA, I believe that the documentation listed on Splunkbase is inadequate and it should list at t... by NullZero Communicator in All Apps and Add-ons 12 hours ago 0 3	0	3
Where spl2-orchestrator.log file rotation configured? I looked in the SPLUNK_HOME/etc/log.cfg and local-log.cfg and can't find any stanzas to change it. I ask because it i... by ravidaj Engager in Splunk Enterprise 13 hours ago 2 3	2	3
Problem on dashboard studio with App's Viz Number display Hi,I find a problem with App's Number Display (https://splunkbase.splunk.com/app/4537) on dashboard Studio when Dashb... by romux72 Explorer in All Apps and Add-ons 13 hours ago 0 2	0	2
Possible Bug found Hi all!Maybe I have found a small bug in the Python for Scientific Computing for Linux 64-bit app.The problem I see i... by Matzi New Member in All Apps and Add-ons yesterday 0 1	0	1
SHC - failed on handle async replicate request I have noticed something odd in a SHC deployment. Im consistently seeing "SHCMasterArtifactHandler - failed on handle... by ahartge Path Finder in Deployment Architecture yesterday 2 4	2	4
Agent Management intermittently unavailable on 10.2.7 (RHEL 8) Environment:- Splunk Enterprise 10.2.7, incrementally upgraded from an older 10.x line- RHEL 8 & Windows Server 2022 ... by BenjaminFinck Explorer in Splunk Enterprise Saturday 0 1	0	1
Search-time JSON field returns incomplete results unless search optimization is disabled We are seeing a large discrepancy when filtering on a JSON-extracted field in Splunk EnterpriseEnvironmentSplunk Ente... by briancronrath Contributor in Splunk Enterprise Friday 0 1	0	1
configuration page wont show I added the Splunk Cisco ISE addon but when i open the app it stays blank. by LESMeeks New Member in All Apps and Add-ons Friday 0 2	0	2
How to I link the Entitlement AppD SaaS controller name to my profile? Why should I have to do your work? Regarding the Cisco Support cutover from AppDynamics Support: I have been an AppDynamics Admin for over 6+ years, and... by Lachnite New Member in Splunk AppDynamics Friday 0 0	0	0
Best Practice on Repeated Charting with a single changed variable. Hello, What is the current best practice for repeated charts where only one variable changes. The suggestions I see a... by strehb18 Path Finder in Dashboards & Visualizations Friday 0 1	0	1
Updating managed lookup via api in cloud Hello Community!We have a particular set of searches that rely on a lookup against a managed lookup (adhock). The lo... by FuzzySteve Loves-to-Learn in Splunk Dev Friday 0 5	0	5
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security are no ... by hilal Loves-to-Learn in Community Blog Friday 3 1	3	1
Cisco Enterprise Networking Add-on Documentation Splunkbase doesn't have a link to the documentation for the newly update Cisco Enterprise Networking add-on and app. ... by kwagner001 Loves-to-Learn in All Apps and Add-ons Thursday 0 2	0	2
Ingest processor pipelines show reduction in data, but Ingest license is showing full data I have two pipelines that reduce the log size of pan:traffic:cloud and pan:threat:cloud by removing fields that do no... by derekmkll Path Finder in Splunk Cloud Platform Thursday 0 14	0	14
All Work and No Play? Not at .conf26! Unwind at These Evening Events Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed with lear... by iamryan Community Manager in Community Blog Thursday 0 0	0	0
Rapid7 InsightVM TA does not always return every vulnerability for an asset We're using Rapid7's InsightVM TA to pull asset vulnerability events into Splunk. Generally, it works well, but we'v... by dkmcclory Path Finder in All Apps and Add-ons Thursday 2 0	2	0
Entity Risk Reduction upon False Positive disposition Hi All,I am trying to build a playbook that reduces the risk of an entity in any of the splunk notable only when the ... by pruthviraj_k_m Explorer in Splunk SOAR Thursday 0 4	0	4
Splunk UF Versions for v11.0.2 of the Splunk Add-on for Microsoft Windows I see some very specific requirements for the latest major version of this TA for Splunk Cloud and Splunk Enterprise.... by sirpatrick Explorer in Getting Data In Thursday 0 2	0	2
Why Windows PSA Support Still Matters for SSO Monitoring Many enterprise applications rely on Windows-based Single Sign-On (SSO) technologies such as Kerberos, NTLM, and Inte... by Seenu_K Engager in Splunk AppDynamics Thursday 1 0	1	0
Where are stored intermediate prestats/data coming from the peers onto the Search Head Hello,In a splunk search, the first transforming command is processed on the indexers and processed data is transfere... by ChrisHms Observer in Deployment Architecture Wednesday 0 3	0	3

Getting Started

Community Blog

Learning Paths

User Groups

Office Hours

Splunk Search

KV Store startup failure: Failed to import PFX file into Keychain

How to view data from Threat intel collections?

The Search shows different results from what the dashboard is showing. They should be the same

Where can I download my Splunk certifications?

Documentation clarity (Python for Scientific Computing)

Where spl2-orchestrator.log file rotation configured?

Problem on dashboard studio with App's Viz Number display

Possible Bug found

SHC - failed on handle async replicate request

Agent Management intermittently unavailable on 10.2.7 (RHEL 8)

Search-time JSON field returns incomplete results unless search optimization is disabled

configuration page wont show

How to I link the Entitlement AppD SaaS controller name to my profile? Why should I have to do your work?

Best Practice on Repeated Charting with a single changed variable.

Updating managed lookup via api in cloud

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Cisco Enterprise Networking Add-on Documentation

Ingest processor pipelines show reduction in data, but Ingest license is showing full data

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Rapid7 InsightVM TA does not always return every vulnerability for an asset

Entity Risk Reduction upon False Positive disposition

Splunk UF Versions for v11.0.2 of the Splunk Add-on for Microsoft Windows

Why Windows PSA Support Still Matters for SSO Monitoring

Where are stored intermediate prestats/data coming from the peers onto the Search Head

Meet the SplunkTrust

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Additional Help & Resources

Community Guidelines

Community Slack Workspace

Splunk Documentation

Join the Conversation

Additional Help & Resources

Meet the SplunkTrust

Additional Help & Resources