Splunk Community

Find answers, ask questions, and connect with our community of consumers and specialists.

123K Members 2,294 Online 158K Posts

Join us for a 4-part series on Full-Stack Observability: For the AI Era consisting of a Webinar, Tech Talk, interactive Lab, and Office Hours

Getting Started

Learn more about the Splunk Community and how we can help

Community Blog

Community happenings, product announcements, and Splunk news

Learning Paths

Discover Community and Learning Resources for your Role

User Groups

Meet up with other Splunk practitioners, virtually or in-person

Meet the SplunkTrust

"Being a member of SplunkTrust as well as a User Group Leader enriches my knowledge of Splunk greatly. I am exposed to and learn so much about Splunk that I can be on top of any new features well ahead of the game." - Becky Burwell

The SplunkTrust is comprised of our most dedicated community members. They assist other members, participate in events, demonstrate the power of Splunk's products, and help guide future roadmaps.

Learn more

Data Management Digest – September 2026

Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of momentum to data management. Edge Processor Hybrid gives teams a way to modernize ingestion ...

Splunk Employee

on Product News & Announcements Friday

Federated Search for CloudWatch Unified Data Store Is Generally Available

As organizations modernize their cloud environments, AWS workloads generate more security, operational, and application telemetry than ever before. That data is valuable—but it does not always need to ...

Splunk Employee

on Product News & Announcements Friday

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and on-premises customers who have upgraded to version 10.4. This transformative update shifts ...

Splunk Employee

on Product News & Announcements Thursday

5431

Analytics Workspace removal in Splunk 10.6

In Splunk Cloud Platform and Splunk Enterprise 10.6, Analytics Workspace is removed from product and no longer supported. To learn more about the removal, visit this Lantern article FAQ.

Splunk Employee

on Product News & Announcements Thursday

103

How do we handle UFs in the enterprise? We have roughly 10k-15k UFs in the company and we wonder in which route to go for ongoing maintenance of the UFs, whe... by ddrillic Ultra Champion in Deployment Architecture yesterday 0 5	0	5
Splunk HF parallel pipelines utilization Hi, We have high-volume syslog input configured on a HF with Splunk v.7.2.5 and we started noticing TailReader-0 pip... by vanvan Path Finder in Monitoring Splunk yesterday 0 4	0	4
Hourly Test Hello all, I am very new to Splunk so apologies if this is an easy one. We want to set up an alert to come out of Spl... by Matt_Splunk Observer in Splunk Search yesterday 0 5	0	5
Add icon to Modern UI navigation bar? Hey there, in the new modern UI, is there any way to use custom icons in the navigation bar? That is, other than the... by BradOH Path Finder in Splunk Enterprise Friday 0 0	0	0
Splunk hosted instance of the BOTS v1.0 dataset I'm trying to access the Splunk hosted instance of the BOTS v1.0 dataset and the link"Splunk Security Dataset Project... by eucrates New Member in Training + Certification Discussions Friday 0 0	0	0
Data Management Digest – September 2026 Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of momentum to da... by MichelleCorpora Splunk Employee in Product News & Announcements Friday 0 0	0	0
Federated Search for CloudWatch Unified Data Store Is Generally Available As organizations modernize their cloud environments, AWS workloads generate more security, operational, and applicati... by kwheeler Splunk Employee in Product News & Announcements Friday 0 0	0	0
integration intune with splunk cloud Guys please help me on how integrate Microsoft Intune to Splunk cloud via graph Api.anyone having SOP please share no... by prajapatidaksh New Member in Splunk Cloud Platform Friday 0 1	0	1
Splunk Add-on for AWS: IAM User works for RDS CloudWatch logs, but IAM Role only paginates DescribeLogStreams Hi everyone,I'm troubleshooting a Splunk Add-on for AWS CloudWatch Logs input that collects Amazon RDS Oracle audit l... by lary925 Observer in All Apps and Add-ons Friday 0 0	0	0
Why Search Head Clustering is always show pending? Some Search Heads show "Up" status but other search heads are always show "Pending". I want to know that how to solve... by Beginner2 Observer in Deployment Architecture Thursday 0 1	0	1
Office Hours \| Ask the Experts: AI Powered Observability “AI + Observability Office Hours: Ask the Experts”October 6, 2026 \| 11:00am – 12:00pm PT AI is transforming the appli... by Anam Community Manager in Community Office Hours Thursday 0 0	0	0
Announcing Modern Navigation: A New Era of Splunk User Experience We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and on-prem... by PreranaD Splunk Employee in Product News & Announcements Thursday 0 16	0	16
Hierarchy within the waslogs monitor stanzas I encountered an interesting case involving a hierarchical set of monitor stanzas within the complex waslogs configur... by ddrillic Ultra Champion in Getting Data In Thursday 0 4	0	4
Splunk HQ Community Welcome Event Splunk HQ Community Welcome Event SWEEPSTAKES Official Rules NO PURCHASE NECESSARY TO ENTER OR WIN. A PURCHASE WILL... by SplunkCommunity Community Manager in Welcome Center Thursday 0 0	0	0
Analytics Workspace removal in Splunk 10.6 In Splunk Cloud Platform and Splunk Enterprise 10.6, Analytics Workspace is removed from product and no longer suppor... by elizabethl_splu Splunk Employee in Product News & Announcements Thursday 0 0	0	0
Use an intermediate universal forwarder Hi at all, I need to send logs from many Universal Forwarders to an Indexer Cluster using an Intermediate Forwarder. ... by gcusello SplunkTrust in Splunk Search Thursday 0 5	0	5
Upgrades to 9.4.15, 10.0.10, 10.2.7 and 10.4.3 fail on CIS-hardened systems (noexec on /var/tmp) Hi all,when upgrading to Splunk Enterprise 9.4.15, 10.0.10, 10.2.7 or 10.4.3 with the .rpm or .deb package, the upgra... by schose Builder in Splunk Enterprise Thursday 2 4	2	4
Error 500 on splunkweb using specific user Hello, since upgrade 9.4.11 from 9.3.0 getting error 500 on splunkweb using local user (works with admin account). Th... by splunkreal Influencer in Splunk Enterprise Thursday 0 1	0	1
Threat intelligence audit dashboard does not work I'm using Splunk enterprise 10.4.0 with es 8.6 installed. But this dashboard is searching threat_intelligence index w... by Jasem New Member in Splunk Enterprise Security Thursday 0 2	0	2
Seeking a supported or community Wiz connector for Splunk SOAR Cloud Title: Seeking a supported or community Wiz connector for Splunk SOAR CloudHi all,We use Wiz for cloud security postu... by Tushar_ph New Member in Splunk SOAR Thursday 0 2	0	2
beam.scs.splunk.com and Splunk Assist app Splunk Assist generating DNS queries to beam.scs.splunk.com every 15 secondsEnvironment: Splunk Enterprise 10.2.3Comp... by Seawheels51 Path Finder in Splunk Enterprise Wednesday 0 0	0	0
Nozomi Networks Universal Add-on - Splunk Enterprise 9.0.10 Compatability I am looking for a version of the Nozomi Networks Universal Add-on that is supported on Splunk Enterprise 9.0.10 and ... by zdunlap Engager in All Apps and Add-ons Wednesday 0 1	0	1
Automatically run a playbook when an investigation starts from a finding Hello,I'm new to Splunk Enterprise Security and I'm building a flow where a finding triggers a playbook that simply s... by josep New Member in Splunk Enterprise Security Wednesday 0 0	0	0
using eval to define actions Morning All I need some help with an spl i am using to define actions requried this is my curretn spl which is worki... by PaulaCom Path Finder in Splunk Search Wednesday 0 5	0	5
Duplicate field values in Splunk events from Cribl Hello,I’m using Cribl Cloud to pull JSON events from an Azure Event Hub and forward them to Splunk via HEC.Each incom... by Raffaele53 Loves-to-Learn in Getting Data In Wednesday 0 7	0	7

Getting Started

Community Blog

Learning Paths

User Groups

Office Hours

How do we handle UFs in the enterprise?

Splunk HF parallel pipelines utilization

Hourly Test

Add icon to Modern UI navigation bar?

Splunk hosted instance of the BOTS v1.0 dataset

Data Management Digest – September 2026

Federated Search for CloudWatch Unified Data Store Is Generally Available

integration intune with splunk cloud

Splunk Add-on for AWS: IAM User works for RDS CloudWatch logs, but IAM Role only paginates DescribeLogStreams

Why Search Head Clustering is always show pending?

Office Hours | Ask the Experts: AI Powered Observability

Announcing Modern Navigation: A New Era of Splunk User Experience

Hierarchy within the waslogs monitor stanzas

Splunk HQ Community Welcome Event

Analytics Workspace removal in Splunk 10.6

Use an intermediate universal forwarder

Upgrades to 9.4.15, 10.0.10, 10.2.7 and 10.4.3 fail on CIS-hardened systems (noexec on /var/tmp)

Error 500 on splunkweb using specific user

Threat intelligence audit dashboard does not work

Seeking a supported or community Wiz connector for Splunk SOAR Cloud

beam.scs.splunk.com and Splunk Assist app

Nozomi Networks Universal Add-on - Splunk Enterprise 9.0.10 Compatability

Automatically run a playbook when an investigation starts from a finding

using eval to define actions

Duplicate field values in Splunk events from Cribl

Meet the SplunkTrust

Data Management Digest – September 2026

Federated Search for CloudWatch Unified Data Store Is Generally Available

Announcing Modern Navigation: A New Era of Splunk User Experience

Analytics Workspace removal in Splunk 10.6

Additional Help & Resources

Community Guidelines

Community Slack Workspace

Splunk Documentation

Join the Conversation

Additional Help & Resources

Meet the SplunkTrust

Additional Help & Resources