Splunk Community

Find answers, ask questions, and connect with our community of consumers and specialists.

122K Members 1,862 Online 157K Posts

Join us for a 4-part series on Splunk Agent Observability consisting of Webinar, Tech Talk, Workshop, and Office Hours

Getting Started

Learn more about the Splunk Community and how we can help

Community Blog

Community happenings, product announcements, and Splunk news

Learning Paths

Discover Community and Learning Resources for your Role

User Groups

Meet up with other Splunk practitioners, virtually or in-person

Meet the SplunkTrust

"Being a member of SplunkTrust as well as a User Group Leader enriches my knowledge of Splunk greatly. I am exposed to and learn so much about Splunk that I can be on top of any new features well ahead of the game." - Becky Burwell

The SplunkTrust is comprised of our most dedicated community members. They assist other members, participate in events, demonstrate the power of Splunk's products, and help guide future roadmaps.

Learn more

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security are no strangers to alert fatigue. A high-severity notable fires, and an analyst ...

Observer

on Community Blog yesterday

1021

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed with learning. But when the breakout rooms clear, it’s time to step away, grab a drink, and ...

Community Manager

on Community Blog Thursday

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent Launchpad to build an AI-powered workflow addressing a real-world Splunk challenge. And ...

Splunk Employee

on Community Blog Wednesday

114

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in Splunk Cloud Platform becomes complex quickly, as an average stack of about 50 applications ...

Splunk Employee

on Splunk Tech Talks Wednesday

120

Agent Management intermittently unavailable on 10.2.7 (RHEL 8) Environment:- Splunk Enterprise 10.2.7, incrementally upgraded from an older 10.x line- RHEL 8 & Windows Server 2022 ... by BenjaminFinck Explorer in Splunk Enterprise 3 hours ago 0 1	0	1
Documentation clarity (Python for Scientific Computing) Some feedback on this TA, I believe that the documentation listed on Splunkbase is inadequate and it should list at t... by NullZero Communicator in All Apps and Add-ons yesterday 0 2	0	2
Search-time JSON field returns incomplete results unless search optimization is disabled We are seeing a large discrepancy when filtering on a JSON-extracted field in Splunk EnterpriseEnvironmentSplunk Ente... by briancronrath Contributor in Splunk Enterprise yesterday 0 1	0	1
configuration page wont show I added the Splunk Cisco ISE addon but when i open the app it stays blank. by LESMeeks New Member in All Apps and Add-ons yesterday 0 2	0	2
How to I link the Entitlement AppD SaaS controller name to my profile? Why should I have to do your work? Regarding the Cisco Support cutover from AppDynamics Support: I have been an AppDynamics Admin for over 6+ years, and... by Lachnite New Member in Splunk AppDynamics yesterday 0 0	0	0
Best Practice on Repeated Charting with a single changed variable. Hello, What is the current best practice for repeated charts where only one variable changes. The suggestions I see a... by strehb18 Path Finder in Dashboards & Visualizations yesterday 0 1	0	1
Updating managed lookup via api in cloud Hello Community!We have a particular set of searches that rely on a lookup against a managed lookup (adhock). The lo... by FuzzySteve Loves-to-Learn in Splunk Dev yesterday 0 5	0	5
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security are no ... by hilal Observer in Community Blog yesterday 3 1	3	1
Cisco Enterprise Networking Add-on Documentation Splunkbase doesn't have a link to the documentation for the newly update Cisco Enterprise Networking add-on and app. ... by kwagner001 Loves-to-Learn in All Apps and Add-ons Thursday 0 2	0	2
Ingest processor pipelines show reduction in data, but Ingest license is showing full data I have two pipelines that reduce the log size of pan:traffic:cloud and pan:threat:cloud by removing fields that do no... by derekmkll Path Finder in Splunk Cloud Platform Thursday 0 14	0	14
All Work and No Play? Not at .conf26! Unwind at These Evening Events Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed with lear... by iamryan Community Manager in Community Blog Thursday 0 0	0	0
Rapid7 InsightVM TA does not always return every vulnerability for an asset We're using Rapid7's InsightVM TA to pull asset vulnerability events into Splunk. Generally, it works well, but we'v... by dkmcclory Path Finder in All Apps and Add-ons Thursday 2 0	2	0
Entity Risk Reduction upon False Positive disposition Hi All,I am trying to build a playbook that reduces the risk of an entity in any of the splunk notable only when the ... by pruthviraj_k_m Explorer in Splunk SOAR Thursday 0 4	0	4
The Search shows different results from what the dashboard is showing. They should be the same Can someone help me optimize this search so the results on the search and dashboard panel should be the same. The sea... by USA69 Explorer in Splunk Search Thursday 0 6	0	6
Splunk UF Versions for v11.0.2 of the Splunk Add-on for Microsoft Windows I see some very specific requirements for the latest major version of this TA for Splunk Cloud and Splunk Enterprise.... by sirpatrick Explorer in Getting Data In Thursday 0 2	0	2
Problem on dashboard studio with App's Viz Number display Hi,I find a problem with App's Number Display (https://splunkbase.splunk.com/app/4537) on dashboard Studio when Dashb... by romux72 Explorer in All Apps and Add-ons Thursday 0 0	0	0
Why Windows PSA Support Still Matters for SSO Monitoring Many enterprise applications rely on Windows-based Single Sign-On (SSO) technologies such as Kerberos, NTLM, and Inte... by Seenu_K Engager in Splunk AppDynamics Thursday 1 0	1	0
Where are stored intermediate prestats/data coming from the peers onto the Search Head Hello,In a splunk search, the first transforming command is processed on the indexers and processed data is transfere... by ChrisHms Observer in Deployment Architecture Wednesday 0 3	0	3
Parsing default.meta with python Hi, in our deployment pipeline we want to check the config of an app. At the moment I try to parse the default.meta ... by kbroeker New Member in Deployment Architecture Wednesday 0 2	0	2
Join the Hackathon at .conf26 and build a No-Code AI agent Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent Launch... by rederada Splunk Employee in Community Blog Wednesday 0 0	0	0
Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform Tech Talk Recap From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in Splunk Clo... by ricarsot Splunk Employee in Splunk Tech Talks Wednesday 0 0	0	0
SPL Find difference from previous day from a DB Source We currently have a DB Connection and a Query which brings in Project Details with the username Entitlements. The Que... by LizAndy123 Path Finder in Splunk Search Wednesday 0 7	0	7
Forwarder Topology Guidance: Intermediate HF vs Intermediate UF Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology guide f... by hrawat Splunk Employee in Community Blog Wednesday 0 1	0	1
Trying to use .* as input parameter of an action when there are multiple values in the list Successful when using finding:consolidated_findings.example.0 or finding:consolidated_findings.example.1 but not when... by jjkel Explorer in Splunk SOAR Wednesday 1 5	1	5
Error while trying to configure app PureStorage Unified addon: Error: Request failed with status code 500 Hello,I'm trying to configure the PureStorage Unified addon, and keep getting the Something went wrong errorAddon:htt... by mcqueen9 Engager in Installation Tuesday 0 1	0	1

Getting Started

Community Blog

Learning Paths

User Groups

Office Hours

Agent Management intermittently unavailable on 10.2.7 (RHEL 8)

Documentation clarity (Python for Scientific Computing)

Search-time JSON field returns incomplete results unless search optimization is disabled

configuration page wont show

How to I link the Entitlement AppD SaaS controller name to my profile? Why should I have to do your work?

Best Practice on Repeated Charting with a single changed variable.

Updating managed lookup via api in cloud

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Cisco Enterprise Networking Add-on Documentation

Ingest processor pipelines show reduction in data, but Ingest license is showing full data

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Rapid7 InsightVM TA does not always return every vulnerability for an asset

Entity Risk Reduction upon False Positive disposition

The Search shows different results from what the dashboard is showing. They should be the same

Splunk UF Versions for v11.0.2 of the Splunk Add-on for Microsoft Windows

Problem on dashboard studio with App's Viz Number display

Why Windows PSA Support Still Matters for SSO Monitoring

Where are stored intermediate prestats/data coming from the peers onto the Search Head

Parsing default.meta with python

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

SPL Find difference from previous day from a DB Source

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Trying to use .* as input parameter of an action when there are multiple values in the list

Error while trying to configure app PureStorage Unified addon: Error: Request failed with status code 500

Meet the SplunkTrust

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Additional Help & Resources

Community Guidelines

Community Slack Workspace

Splunk Documentation

Join the Conversation

Additional Help & Resources

Meet the SplunkTrust

Additional Help & Resources