Splunk Community

Find answers, ask questions, and connect with our community of consumers and specialists.

123K Members 1,224 Online 158K Posts

Ready to Level Up? Here Are 3 Ways AI Can Optimize Your Day.

Getting Started

Learn more about the Splunk Community and how we can help

Community Blog

Community happenings, product announcements, and Splunk news

Learning Paths

Discover Community and Learning Resources for your Role

User Groups

Meet up with other Splunk practitioners, virtually or in-person

Meet the SplunkTrust

"Being a member of SplunkTrust as well as a User Group Leader enriches my knowledge of Splunk greatly. I am exposed to and learn so much about Splunk that I can be on top of any new features well ahead of the game." - Becky Burwell

The SplunkTrust is comprised of our most dedicated community members. They assist other members, participate in events, demonstrate the power of Splunk's products, and help guide future roadmaps.

Learn more

Splunk Enterprise Security: An Automated Phishing Response Workflow

Originally posted on Splunk.com. Key takeaways The volume of phishing emails can overwhelm even the most dedicated security teams. Automation is key to mitigating phishing-related risk and the ...

Splunk Employee

on Community Blog 2 hours ago

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key use cases for Security, Observability, Industries, AI, and Cisco. We also host valuable ...

Splunk Employee

on Community Blog 2 hours ago

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a user files an incident about an index having no data for the last 2 weeks! Scrambling to get ...

Super Champion

on Community Blog yesterday

147

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, federated datasets, and Machine Data Lake, and promote Machine Data Lake data when it is ...

Splunk Employee

on Product News & Announcements yesterday

Splunk Enterprise Security: An Automated Phishing Response Workflow Originally posted on Splunk.com. Key takeaways The volume of phishing emails can overwhelm even the most dedicated... by abheyk Splunk Employee in Community Blog 2 hours ago 0 0	0	0
Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More from Splunk Lantern Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key use ca... by KayeChapman Splunk Employee in Community Blog 2 hours ago 0 0	0	0
Message Trace Ingestion Failing with 403 Forbidden Error Hello,I'm currently onboarding Microsoft Office 365 logs into Splunk using the Splunk Add-on for Microsoft Office 365... by NightOwl2212 New Member in Getting Data In 9 hours ago 0 0	0	0
Why are we experiencing this Error "authentication failure on Phantom 4.10"? We are using Prompt with extended time to 4 days. We have discovered that when the time of running playbook is over t... by mrzn New Member in Splunk SOAR 10 hours ago 0 3	0	3
g suite integration to Splunk platform gmail logs ingestion to Splunk platform. pls do share for any pointers. by manas123 New Member in Getting Data In 10 hours ago 0 1	0	1
First time - How to configure Alerting in Splunk This was the first time in our clustered Splunk instance which contains 3 Search heads and one AWS ALB attached to it... by Karthikeya Communicator in Splunk Enterprise 10 hours ago 0 4	0	4
Global config JSON file not found!` error in `sendtophantom` modular alert despite placing `globalConfig.json` across ca Hi everyone,I am facing an persistent issue with the Splunk Add-on for Phantom (`sendtophantom` modular action) when ... by kn450 Explorer in Splunk SOAR yesterday 0 0	0	0
How would you ingest AI-image review CSV metadata into Splunk without the images? I am planning a small provenance-review workflow for image submissions to an editorial team. The team may check batch... by eeaichekkaa New Member in Getting Data In yesterday 0 1	0	1
How should Splunk track human review of AI-generated draft text without storing the draft? I am designing a review trail for a small editorial workflow. The content team checks Japanese and English draft arti... by eeaichekkaa New Member in All Apps and Add-ons yesterday 0 1	0	1
SC4S parsing issues I have set SC4S up using Docker CE and systemd. In env file, I have a HEC endpoint url and a custom UDP port open, he... by Jasem Explorer in Getting Data In yesterday 0 1	0	1
Data Outage Monitoring and Reporting We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a user file... by clara-fication Super Champion in Community Blog yesterday 3 0	3	0
Manage Datasets and Connections in Catalog on Splunk Cloud Platform Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, federated da... by teja_gattupalli Splunk Employee in Product News & Announcements yesterday 0 0	0	0
Re-opened Finding Groups in an Investigation Hi, I'm testing Finding Based Detections. So far Finding Groups are created and Reopenability seems to work.I was won... by peterschloenske Path Finder in Splunk Enterprise Security yesterday 0 0	0	0
Upgrades to 9.4.15, 10.0.10, 10.2.7 and 10.4.3 fail on CIS-hardened systems (noexec on /var/tmp) Hi all,when upgrading to Splunk Enterprise 9.4.15, 10.0.10, 10.2.7 or 10.4.3 with the .rpm or .deb package, the upgra... by schose Builder in Splunk Enterprise yesterday 3 5	3	5
Persistent Queue at TcpOut — One of Splunk's Most Practical Features Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in recent ... by hrawat Splunk Employee in Community Blog Friday 4 1	4	1
Splunk Cloud: Can indexes retain data beyond 90 days without additional DDAS? Hi everyone,I have a question about searchable data retention in Splunk Cloud (Victoria Experience).With a subscripti... by tomasb Engager in Splunk Cloud Platform Friday 0 2	0	2
AppDynamics and Microsoft copilot anyone know of a way to integrate AppDynamics with MS Copilot? Not sure what all I want it to do, but I am not findi... by Bobby_Wood New Member in Splunk AppDynamics Friday 0 0	0	0
Catalog Is Now Generally Available on Splunk Cloud Platform A Unified View of Your Data Security logs, application events, business data, and historical telemetry often live in... by teja_gattupalli Splunk Employee in Product News & Announcements Friday 0 1	0	1
Splunk SOAR 8.5 On-Premises: Report Scheduling Time Zone Precedence and Report Generation/Download Issues Hi Splunk Community,We are new to Splunk SOAR and are currently exploring the built-in Reports functionality. We woul... by joewang123 New Member in Splunk SOAR Thursday 0 0	0	0
Duplicate field values in Splunk events from Cribl Hello,I’m using Cribl Cloud to pull JSON events from an Azure Event Hub and forward them to Splunk via HEC.Each incom... by Raffaele53 Loves-to-Learn in Getting Data In Thursday 0 8	0	8
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Watch on demand us for a demo-driven look at ... by LesediK Splunk Employee in Splunk Tech Talks Thursday 0 1	0	1
How to propagate a newly created index name to be listed on the HF apps? When we create a new index on the cloud, this index doesn't show up in the drop-downs on the various apps that are on... by ddrillic Ultra Champion in Getting Data In Thursday 0 4	0	4
The Data Connection - October 2026 We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, where sho... by MichelleCorpora Splunk Employee in Product News & Announcements Thursday 1 0	1	0
Custom provider issue with AI toolkit Hello, getting error with AI toolkit and custom provider (litellm), anyone managed to make it work?splunk server 9.3.... by splunkreal Influencer in All Apps and Add-ons Thursday 0 8	0	8
Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience Resources Customer success is built on tailored guidance and accessible resources. As a Splunk user, you are encouraged to tap ... by bevsmart Splunk Employee in Community Blog Thursday 0 0	0	0

Getting Started

Community Blog

Learning Paths

User Groups

Office Hours

Splunk Enterprise Security: An Automated Phishing Response Workflow

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More from Splunk Lantern

Message Trace Ingestion Failing with 403 Forbidden Error

Why are we experiencing this Error "authentication failure on Phantom 4.10"?

g suite integration to Splunk platform

First time - How to configure Alerting in Splunk

Global config JSON file not found!` error in `sendtophantom` modular alert despite placing `globalConfig.json` across ca

How would you ingest AI-image review CSV metadata into Splunk without the images?

How should Splunk track human review of AI-generated draft text without storing the draft?

SC4S parsing issues

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Re-opened Finding Groups in an Investigation

Upgrades to 9.4.15, 10.0.10, 10.2.7 and 10.4.3 fail on CIS-hardened systems (noexec on /var/tmp)

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk Cloud: Can indexes retain data beyond 90 days without additional DDAS?

AppDynamics and Microsoft copilot

Catalog Is Now Generally Available on Splunk Cloud Platform

Splunk SOAR 8.5 On-Premises: Report Scheduling Time Zone Precedence and Report Generation/Download Issues

Duplicate field values in Splunk events from Cribl

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

How to propagate a newly created index name to be listed on the HF apps?

The Data Connection - October 2026

Custom provider issue with AI toolkit

Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience Resources

Meet the SplunkTrust

Splunk Enterprise Security: An Automated Phishing Response Workflow

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More from Splunk ...

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Additional Help & Resources

Community Guidelines

Community Slack Workspace

Splunk Documentation

Join the Conversation

Additional Help & Resources

Meet the SplunkTrust

Additional Help & Resources