Splunk Community

Find answers, ask questions, and connect with our community of consumers and specialists.

123K Members 4,050 Online 158K Posts

Join us for a 4-part series on Full-Stack Observability: For the AI Era consisting of a Webinar, Tech Talk, interactive Lab, and Office Hours

Getting Started

Learn more about the Splunk Community and how we can help

Community Blog

Community happenings, product announcements, and Splunk news

Learning Paths

Discover Community and Learning Resources for your Role

User Groups

Meet up with other Splunk practitioners, virtually or in-person

Meet the SplunkTrust

"Being a member of SplunkTrust as well as a User Group Leader enriches my knowledge of Splunk greatly. I am exposed to and learn so much about Splunk that I can be on top of any new features well ahead of the game." - Becky Burwell

The SplunkTrust is comprised of our most dedicated community members. They assist other members, participate in events, demonstrate the power of Splunk's products, and help guide future roadmaps.

Learn more

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and on-premises customers who have upgraded to version 10.4. This transformative update shifts ...

Splunk Employee

on Product News & Announcements 5 hours ago

5360

Analytics Workspace removal in Splunk 10.6

In Splunk Cloud Platform and Splunk Enterprise 10.6, Analytics Workspace is removed from product and no longer supported. To learn more about the removal, visit this Lantern article FAQ.

Splunk Employee

on Product News & Announcements 5 hours ago

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought together Splunk app developers, app owners and curious newcomers for a hands-on experience focused on one ...

Splunk Employee

on Community Blog Tuesday

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University classrooms to certification milestones and hundreds of challenges completed in the ...

Splunk Employee

on Training & Certification Blog Monday

Office Hours \| Ask the Experts: AI Powered Observability “AI + Observability Office Hours: Ask the Experts”October 6, 2026 \| 11:00am – 12:00pm PT AI is transforming the appli... by Anam Community Manager in Community Office Hours 3 hours ago 0 0	0	0
Announcing Modern Navigation: A New Era of Splunk User Experience We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and on-prem... by PreranaD Splunk Employee in Product News & Announcements 5 hours ago 0 16	0	16
Hierarchy within the waslogs monitor stanzas I encountered an interesting case involving a hierarchical set of monitor stanzas within the complex waslogs configur... by ddrillic Ultra Champion in Getting Data In 5 hours ago 0 4	0	4
Splunk HQ Community Welcome Event Splunk HQ Community Welcome Event SWEEPSTAKES Official Rules NO PURCHASE NECESSARY TO ENTER OR WIN. A PURCHASE WILL... by SplunkCommunity Community Manager in Welcome Center 5 hours ago 0 0	0	0
Analytics Workspace removal in Splunk 10.6 In Splunk Cloud Platform and Splunk Enterprise 10.6, Analytics Workspace is removed from product and no longer suppor... by elizabethl_splu Splunk Employee in Product News & Announcements 5 hours ago 0 0	0	0
Use an intermediate universal forwarder Hi at all, I need to send logs from many Universal Forwarders to an Indexer Cluster using an Intermediate Forwarder. ... by gcusello SplunkTrust in Splunk Search 7 hours ago 0 5	0	5
Upgrades to 9.4.15, 10.0.10, 10.2.7 and 10.4.3 fail on CIS-hardened systems (noexec on /var/tmp) Hi all,when upgrading to Splunk Enterprise 9.4.15, 10.0.10, 10.2.7 or 10.4.3 with the .rpm or .deb package, the upgra... by schose Builder in Splunk Enterprise 11 hours ago 2 4	2	4
Error 500 on splunkweb using specific user Hello, since upgrade 9.4.11 from 9.3.0 getting error 500 on splunkweb using local user (works with admin account). Th... by splunkreal Influencer in Splunk Enterprise 11 hours ago 0 1	0	1
integration intune with splunk cloud Guys please help me on how integrate Microsoft Intune to Splunk cloud via graph Api.anyone having SOP please share no... by prajapatidaksh New Member in Splunk Cloud Platform 12 hours ago 0 0	0	0
Threat intelligence audit dashboard does not work I'm using Splunk enterprise 10.4.0 with es 8.6 installed. But this dashboard is searching threat_intelligence index w... by Jasem New Member in Splunk Enterprise Security 12 hours ago 0 2	0	2
Seeking a supported or community Wiz connector for Splunk SOAR Cloud Title: Seeking a supported or community Wiz connector for Splunk SOAR CloudHi all,We use Wiz for cloud security postu... by Tushar_ph New Member in Splunk SOAR 14 hours ago 0 2	0	2
Hourly Test Hello all, I am very new to Splunk so apologies if this is an easy one. We want to set up an alert to come out of Spl... by Matt_Splunk Observer in Splunk Search yesterday 0 4	0	4
beam.scs.splunk.com and Splunk Assist app Splunk Assist generating DNS queries to beam.scs.splunk.com every 15 secondsEnvironment: Splunk Enterprise 10.2.3Comp... by Seawheels51 Path Finder in Splunk Enterprise yesterday 0 0	0	0
Nozomi Networks Universal Add-on - Splunk Enterprise 9.0.10 Compatability I am looking for a version of the Nozomi Networks Universal Add-on that is supported on Splunk Enterprise 9.0.10 and ... by zdunlap Engager in All Apps and Add-ons yesterday 0 1	0	1
Automatically run a playbook when an investigation starts from a finding Hello,I'm new to Splunk Enterprise Security and I'm building a flow where a finding triggers a playbook that simply s... by josep New Member in Splunk Enterprise Security yesterday 0 0	0	0
using eval to define actions Morning All I need some help with an spl i am using to define actions requried this is my curretn spl which is worki... by PaulaCom Path Finder in Splunk Search yesterday 0 5	0	5
Duplicate field values in Splunk events from Cribl Hello,I’m using Cribl Cloud to pull JSON events from an Azure Event Hub and forward them to Splunk via HEC.Each incom... by Raffaele53 Loves-to-Learn in Getting Data In yesterday 0 7	0	7
Why is every web login to splunk 10.4.3 failing in the UX Hi,We upgraded recently splunk from 9.4.3 to 10.4.3 and it seems like logging in from the Web GUI fails every single ... by kaurinko Communicator in Splunk Enterprise yesterday 0 4	0	4
How to work out the age of a user based on date of birth? I want to group users by their age which range from roughly 5 years to 90. The dateofbirth field is formatted like th... by Amohlmann Communicator in Splunk Search Tuesday 0 13	0	13
Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar If you stopped by the Builder Bar at .conf26, thank you! This year, we brought together Splunk app developers, app ow... by rederada Splunk Employee in Community Blog Tuesday 0 0	0	0
Are all logs in splunk's var/log/splunk directory indexed by default? Hello, we have "opencti_create_incident_modalert.log" file generated in splunk/var/log/splunk on search heads (SHC) h... by splunkreal Influencer in All Apps and Add-ons Tuesday 0 8	0	8
Defining sourcetype in collect destroys event-splitting Hi,I tried to create a summary-event index using collect. The aim was to be able to define some things that the stand... by kaurinko Communicator in Splunk Enterprise Tuesday 0 7	0	7
Oauth not working for Splunk Add-on We recently rolled out a new version of our Splunk Add-on. When the customers upgraded to this new version (this cont... by ServiceNow_SecO Loves-to-Learn in All Apps and Add-ons Tuesday 0 1	0	1
Automating Splunk query results I would like to use AI tool to automate the Splunk search capability. For instance, instead of using Splunk search us... by senmng New Member in Dashboards & Visualizations Tuesday 0 2	0	2
I keep getting triggered alerts even after the cpu comes back to normal idle This query works. I get a triggered alert if the cpu is running high over 90% for 5 consecutive minutes. But when th... by hotrodbass Explorer in Alerting Tuesday 0 3	0	3

Getting Started

Community Blog

Learning Paths

User Groups

Office Hours

Office Hours | Ask the Experts: AI Powered Observability

Announcing Modern Navigation: A New Era of Splunk User Experience

Hierarchy within the waslogs monitor stanzas

Splunk HQ Community Welcome Event

Analytics Workspace removal in Splunk 10.6

Use an intermediate universal forwarder

Upgrades to 9.4.15, 10.0.10, 10.2.7 and 10.4.3 fail on CIS-hardened systems (noexec on /var/tmp)

Error 500 on splunkweb using specific user

integration intune with splunk cloud

Threat intelligence audit dashboard does not work

Seeking a supported or community Wiz connector for Splunk SOAR Cloud

Hourly Test

beam.scs.splunk.com and Splunk Assist app

Nozomi Networks Universal Add-on - Splunk Enterprise 9.0.10 Compatability

Automatically run a playbook when an investigation starts from a finding

using eval to define actions

Duplicate field values in Splunk events from Cribl

Why is every web login to splunk 10.4.3 failing in the UX

How to work out the age of a user based on date of birth?

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Are all logs in splunk's var/log/splunk directory indexed by default?

Defining sourcetype in collect destroys event-splitting

Oauth not working for Splunk Add-on

Automating Splunk query results

I keep getting triggered alerts even after the cpu comes back to normal idle

Meet the SplunkTrust

Announcing Modern Navigation: A New Era of Splunk User Experience

Analytics Workspace removal in Splunk 10.6

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Thanks for the Memories: .conf26 Took Learning to New Heights

Additional Help & Resources

Community Guidelines

Community Slack Workspace

Splunk Documentation

Join the Conversation

Additional Help & Resources

Meet the SplunkTrust

Additional Help & Resources