Splunk Community

Find answers, ask questions, and connect with our community of consumers and specialists.

123K Members 1,616 Online 158K Posts

Join us for a 4-part series on Full-Stack Observability: For the AI Era consisting of a Webinar, Tech Talk, interactive Lab, and Office Hours

Getting Started

Learn more about the Splunk Community and how we can help

Community Blog

Community happenings, product announcements, and Splunk news

Learning Paths

Discover Community and Learning Resources for your Role

User Groups

Meet up with other Splunk practitioners, virtually or in-person

Meet the SplunkTrust

"Being a member of SplunkTrust as well as a User Group Leader enriches my knowledge of Splunk greatly. I am exposed to and learn so much about Splunk that I can be on top of any new features well ahead of the game." - Becky Burwell

The SplunkTrust is comprised of our most dedicated community members. They assist other members, participate in events, demonstrate the power of Splunk's products, and help guide future roadmaps.

Learn more

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without Leaving Your IDE

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ships, the sprint closes, and the OpenTelemetry work lands in the backlog until something ...

Splunk Employee

on Community Blog 2 hours ago

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk Cloud Platform

Federated Search for Cisco Security Analytics and Logging (SAL) is now generally available as part of the Splunk Cloud Platform v10.6.x release. This release brings historical firewall telemetry into ...

Splunk Employee

on Product News & Announcements 2 hours ago

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Join us for a demo-driven look at how Splunk supports this spectrum of agentic experiences. Start with AI Assistant in agentic ...

Splunk Employee

on Splunk Tech Talks 4 hours ago

Supercharging Windows Security Detection Performance: Introducing Hybrid Field Extractions

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone of modern Security Operations Centers (SOCs). However, in high-throughput environments, ...

Splunk Employee

on Community Blog yesterday

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without Leaving Your IDE Instrumentation is usually the last step or even an afterthought when building out a project. The feature ships, the ... by CaitlinHalla Splunk Employee in Community Blog 2 hours ago 1 0	1	0
Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk Cloud Platform Federated Search for Cisco Security Analytics and Logging (SAL) is now generally available as part of the Splunk Clo... by NithinKR Splunk Employee in Product News & Announcements 2 hours ago 0 0	0	0
SPL map command Good morning all,I run this search\| makeresults count=4 \| eval a="splunk_server" \| map search="search index=esak-qa s... by torustad Path Finder in Splunk Search 3 hours ago 0 19	0	19
Index time field extraction for XML data? We have a use case where index time extractions for XML data makes a lot of sense yet I do not see an easy way go mak... by ebaileytu Communicator in Splunk Search 3 hours ago 0 6	0	6
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Join us for a demo-driven look at how Splunk ... by LesediK Splunk Employee in Splunk Tech Talks 4 hours ago 0 0	0	0
ORA-17002: I/O error: IO Error (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPa Hi Everyone, we are using Splunk DB Connect 4.3.0 along with splunk 10.4.1 version, we had existing connections using... by maheshnc Path Finder in Getting Data In 8 hours ago 0 1	0	1
Want a replacement for TA Zeek JSON Parsing. The latest Splunk Enterprise version that is Splunk 10.6.0.5 do not have the App "TA Zeek JSON Parsing". How can we r... by saised New Member in Splunk Enterprise 8 hours ago 0 1	0	1
Dashboard Studio table filter only works for values visible on page 1, fails for values from later pages until dashboard Splunk version 10.4 Victoria:I'm experiencing inconsistent filtering behavior in a Dashboard Studio table that uses a... by iamvikasjha New Member in Splunk Cloud Platform 10 hours ago 0 0	0	0
splunk/create React App, make view globally available Hi fellow splunkers,i developed a monorepo app with a basic page as view and want to make the view globally available... by TheEggi98 Path Finder in Splunk Enterprise 10 hours ago 0 0	0	0
LineBreakingProcessor and structuredparsing doesn't obey TRUNCATE Hi,I seem to receive warnings like the one below:LineBreakingProcessor [1616 structuredparsing] - Truncating line bec... by kaurinko Communicator in Splunk Enterprise 11 hours ago 0 6	0	6
Issues after upgrade to 10.6.0.5 Hi all,after upgrading Splunk Enterprise from 10.4.3 to 10.6.0.5 there are some issues:Management of apps isn't worki... by TheExpert Path Finder in Splunk Enterprise yesterday 0 5	0	5
Supercharging Windows Security Detection Performance: Introducing Hybrid Field Extractions Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone of mod... by hrawat Splunk Employee in Community Blog yesterday 0 0	0	0
Error saving event-based detection. Missing detection_id for the detection= Unable to update and save detections after upgrading to Splunk ES version 8.1.0. It says Detection ID is missing. by BJ17 Explorer in Splunk Enterprise Security yesterday 0 5	0	5
Ditch the Manual Grind: Building AI Agents with Splunk Ditch the Manual Grind: Building AI Agents with Splunk Let’s be real: your team’s time is being eaten alive. Between ... by LesediK Splunk Employee in Splunk Tech Talks yesterday 0 0	0	0
_configtracker in Splunk Cloud? Hello all, I'm trying to get data from _configtracker in Splunk Cloud, as I cannot seem to find saved search changes... by Jakob45a New Member in Monitoring Splunk yesterday 0 1	0	1
Forwarder Ingestion Latency Hi , did anyone faced this issue before ? how I can solve that BTW the unhealthy instances are indexers by Omar_Khaled Observer in Splunk Enterprise yesterday 0 9	0	9
Add zone tags to data passing HFs Hello If I has several network zones and a HF in each zone forwarding logs to indexer cluster, what would be the best... by Jasem New Member in Getting Data In Tuesday 0 3	0	3
Splunkd logs are registering in Russian Language In our environment the Splunkd.log are registering in Russian and English language.Kindly refer to the attached scree... by Prudhvi_k Loves-to-Learn Lots in Splunk Cloud Platform Tuesday 0 2	0	2
Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not? There are conflicting statements in Splunk ITSI 4.21 documentation about being able to use adaptive thresholding on p... by andrew_f_trobec Explorer in Splunk Enterprise Tuesday 0 2	0	2
conditional execution of search Hello, I have a parts of the search, which I would like to execute conditionally. In the below example I am trying t... by damucka Builder in Splunk Search Tuesday 0 18	0	18
Clickable link in an alert email Good afternoon,I am trying to generate an alert email with a clickable link included. What is the correct way to do a... by torustad Path Finder in Splunk Enterprise Monday 0 2	0	2
Blacklist files by content We have all of our Windows workstations sending PowerShell transcripts to a central drop share for ingest. This work... by jdmeek Explorer in Getting Data In Monday 0 2	0	2
How to configure Splunk DB Connect for Trellix ePO (ESS 5.x) audit log ingestion to meet STIG compliance? We needed to ingest Trellix/McAfee ePO audit logs (dbo.OrionAuditLog) into Splunk using DB Connect while establishing... by youngso SplunkTrust in All Apps and Add-ons Monday 0 1	0	1
Full-Stack Observability Office Hours: Ask the Experts Full-Stack Observability Office Hours: Ask the ExpertsOctober 22nd 2026 \| 11:00am – 12:00pm PT As AI reshapes appli... by Anam Community Manager in Community Office Hours Monday 0 0	0	0
Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More from Splunk Lantern Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key use ca... by KayeChapman Splunk Employee in Community Blog Monday 0 0	0	0

Getting Started

Community Blog

Learning Paths

User Groups

Office Hours

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without Leaving Your IDE

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk Cloud Platform

SPL map command

Index time field extraction for XML data?

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

ORA-17002: I/O error: IO Error (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPa

Want a replacement for TA Zeek JSON Parsing.

Dashboard Studio table filter only works for values visible on page 1, fails for values from later pages until dashboard

splunk/create React App, make view globally available

LineBreakingProcessor and structuredparsing doesn't obey TRUNCATE

Issues after upgrade to 10.6.0.5

Supercharging Windows Security Detection Performance: Introducing Hybrid Field Extractions

Error saving event-based detection. Missing detection_id for the detection=

Ditch the Manual Grind: Building AI Agents with Splunk

_configtracker in Splunk Cloud?

Forwarder Ingestion Latency

Add zone tags to data passing HFs

Splunkd logs are registering in Russian Language

Does Splunk ITSI 4.21 support per-entity adaptive thresholding or not?

conditional execution of search

Clickable link in an alert email

Blacklist files by content

How to configure Splunk DB Connect for Trellix ePO (ESS 5.x) audit log ingestion to meet STIG compliance?

Full-Stack Observability Office Hours: Ask the Experts

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More from Splunk Lantern

Meet the SplunkTrust

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without Leaving Your IDE

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk Cloud Platform

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Supercharging Windows Security Detection Performance: Introducing Hybrid Field Extractions

Additional Help & Resources

Community Guidelines

Community Slack Workspace

Splunk Documentation

Join the Conversation

Additional Help & Resources

Meet the SplunkTrust

Additional Help & Resources