![\"password](\"https://community.splunk.com/t5/image/serverpage/image-id/42485i6866598ED4E07EFC/image-size/large?v=v2&px=999\" "\\"splunk.png\\"")
password resetHi @sakib ,
Short answer: yes, this is normal, and no, that row is not one host.
Squashing isn't a rounding artifact — it's an aggregation. The license manager tracks usage per (host, source, sourcetype, index) tuple. When the number of distinct tuples in a reporting interval exceeds squash_threshold (default 2000 in server.conf [license]), Splunk drops the h (host) and s (source) values and keeps only st (sourcetype) and idx (index).
So that blank-host row is the sum of every host that got squashed for that sourcetype/index. If you have a few thousand forwarders, or syslog data where each device IP becomes its own host, 100+ GB/day collapsing into one squashed row is entirely expected. The volume is real; the attribution is what's lost.
Two consequences worth knowing:
index=_internal source=*license_usage.log* type=Usage\n| stats sum(b) as bytes by idx, st, h\n| eval gb=round(bytes/1024/1024/1024,2)\n| sort - gb
To confirm squashing is actually happening and see how much is affected:
index=_internal source=*license_usage.log* type=Usage\n| eval squashed=if(h=\"\",\"squashed\",\"attributed\")\n| stats sum(b) as bytes by squashed\n| eval gb=round(bytes/1024/1024/1024,2)
Also check for the warning on the license manager:
index=_internal source=*splunkd.log* squash
Since idx and st survive, use them to narrow, then attribute from the raw data instead of the license log.
Option A — metrics.log (fast, approximate)
index=_internal source=*metrics.log* group=per_host_thruput\n| stats sum(kb) as kb by series\n| eval gb=round(kb/1024/1024,2)\n| sort - gb
Caveat: metrics.log reports only the top 10 series per interval and lumps the rest into other. Great for spotting a dominant talker, unreliable for a long tail. Run it per indexer (by host, series) since each indexer reports its own.
Option B — measure raw bytes directly (accurate, expensive)
Take the idx and st from the squashed row and run over a short window:
index=<the_index> sourcetype=<the_sourcetype> earliest=-1h latest=now\n| eval raw_len=len(_raw)\n| stats sum(raw_len) as bytes, count as events by host\n| eval gb=round(bytes/1024/1024/1024,3), avg_size=round(bytes/events)\n| sort - gb
One hour, then multiply by 24. Run it off-peak — it scans raw data. The avg_size column often reveals the culprit immediately (a misconfigured input producing huge events, or a debug-level source).
Option C — tstats for a fast ranking (event counts, not bytes)
| tstats count where index=<the_index> by host, sourcetype\n| sort - count
Doesn't give bytes, but it's near-instant and usually points straight at the offender. Combine with Option B on just the top few hosts.
Option D — stop the squashing
On the license manager, server.conf:
[license]\nsquash_threshold = 5000
Restart required. This costs memory on the license manager (it holds all those tuples), so raise it deliberately rather than to an arbitrary large number. Splunk's own guidance is to keep it as low as you can live with. Useful as a temporary measure while you investigate, then put it back.
Squashing that appears suddenly, alongside a usage spike, is itself a clue: it usually means a new source started creating many distinct hosts — syslog with per-device hosts, a Kubernetes/container input where each pod becomes a host, or host_segment/host_regex misconfigured so every file path yields a new host value. Comparing distinct host counts before and after the spike often finds it faster than chasing bytes:
index=_internal source=*license_usage.log* type=Usage earliest=-14d\n| timechart span=1d dc(h) as distinct_hosts, sum(b) as bytes
If distinct_hosts jumped on the same day as the volume, that's your answer.
Hit Karma, if you found the your answer.
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"763011","href":"/conversations/763011","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Blank-host-in-license-usage-log-showing-100GB-daily-usage-Is/td-p/763011","style":"forum","thread_style":"forum","messages_count":2,"solved":false,"last_post_time":"2026-08-20T06:56:48.894-07:00","last_post_time_friendly":"4m ago"},"topic":{"type":"message","id":"763011","href":"/messages/763011","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Blank-host-in-license-usage-log-showing-100GB-daily-usage-Is/m-p/763011#M24532"},"parent":{"type":"message","id":"763011","href":"/messages/763011","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Blank-host-in-license-usage-log-showing-100GB-daily-usage-Is/m-p/763011#M24532"},"post_time":"2026-08-20T06:56:48.894-07:00","post_time_friendly":"4m ago","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":0},"current_revision":{"type":"revision","id":"763027_1","last_edit_author":{"type":"user","id":"318097","href":"/users/318097","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/318097","login":"Happy_16"},"last_edit_time":"2026-08-20T06:56:48.894-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763027'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763027'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763027'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763027'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763027'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763027'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763027'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763027'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763027'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-0.06413194444444445,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763026","href":"/messages/763026","view_href":"https://community.splunk.com/t5/Splunk-Enterprise-Security/Investigations-disappearing-in-Analyst-Queue/m-p/763026#M13019","author":{"type":"user","id":"273721","href":"/users/273721","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/273721","login":"splunker_ak"},"subject":"Re: Investigations disappearing in Analyst Queue","search_snippet":"Seeing the same on 8.3.0, so this isn't limited to 8.4 and downgrading to n-1 doesn't avoid it. I've posted a fuller diagnosis here: https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-8...","body":"Seeing the same on 8.3.0, so this isn't limited to 8.4 and downgrading to n-1 doesn't avoid it. I've posted a fuller diagnosis here:
https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-8-3-0-8-4-investigations-silently-missing-from-Analyst-Queue/td-p/763025
. Short version — the Analyst Queue list is driven by index=mc_investigations while the detail panel reads the KV Store, and the index write is silently skipped for a subset of investigations. | inputlookup mc_investigations_lookup returns everything as a stopgap.
Following on from an earlier thread where investigations appear in the Analyst Queue for a second and then vanish. That thread was closed with \"it's a known issue in 8.4, downgrade to n-1\". I'm seeing the identical behaviour on ES 8.3.0, so downgrading is not a way out of it. Sharing what I found in case it helps others, and hoping someone has seen a fix.
Investigations are created successfully and are fully usable — they open by reference ID, findings attach, notes save. They simply never appear in the Analyst Queue list. Roughly 1 in 4 is affected, consistently, over a 90-day period.
The Analyst Queue list is driven by index=mc_investigations. The investigation detail panel reads the mc_incidents KV Store directly. A record only appears in the list if it exists in both places.
The affected investigations exist in the KV Store but have no matching event in the index. That is the whole symptom — nothing is deleted, nothing is corrupted.
This gives you the exact records that are invisible:
| inputlookup mc_investigations_lookup\n| rename _key as id\n| join type=left id [ search index=mc_investigations earliest=0 | stats count as indexed by id ]\n| fillnull indexed value=0\n| where indexed=0\n| table display_id create_time
And the overall rate:
| inputlookup mc_investigations_lookup\n| rename _key as id\n| join type=left id [ search index=mc_investigations earliest=0 | stats count as indexed by id ]\n| fillnull indexed value=0\n| stats count as created, sum(eval(if(indexed>0,1,0))) as written\n| eval missing=created-written, miss_pct=round(missing/created*100,1)
Note create_time in the lookup is epoch seconds.
The index write happens in missioncontrol/bin/blueridge/incidents.py, in a helper that builds a stash file (StashNewWriter) rather than indexing directly. There are three call sites, all gated on the same internal list of \"created investigations\".
That list is only populated when the investigation ID is not already present in the KV Store at the moment update patches are generated. If the record is already persisted at that point, the ID is never added, every write site skips it, and there is no else branch and no log line. No ERROR, no WARN, nothing.
Confirmed by log evidence — three investigations created on the same node within 40 minutes:
| A | no entry at all | no | no |
| B | full trace | yes | yes |
| C | full trace | yes | yes |
A time-scoped search across all search heads over the failing investigation's creation window returns zero create_incident log events. The failure handler for a genuine write failure logs \"Failed to write investigation to mc_investigations index\" — that message appears zero times in 30 days.
Until there's a fix, the KV Store lookup returns everything, including the invisible records:
| inputlookup mc_investigations_lookup | sort - create_time
I've built a dashboard on that with status/urgency/assignee filters and a column flagging which records are missing from the queue. It's not a fix, but it unblocks analysts completely.
","teaser":"","board":{"type":"board","id":"security-splunk-enterprise-security","href":"/boards/security-splunk-enterprise-security","view_href":"https://community.splunk.com/t5/Splunk-Enterprise-Security/bd-p/security-splunk-enterprise-security"},"conversation":{"type":"conversation","id":"763025","href":"/conversations/763025","view_href":"https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-8-3-0-8-4-investigations-silently-missing-from-Analyst-Queue/td-p/763025","style":"forum","thread_style":"forum","messages_count":1,"solved":false,"last_post_time":"2026-08-20T04:34:48.726-07:00","last_post_time_friendly":"2 hours ago"},"topic":{"type":"message","id":"763025","href":"/messages/763025","view_href":"https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-8-3-0-8-4-investigations-silently-missing-from-Analyst-Queue/m-p/763025#M13018"},"post_time":"2026-08-20T04:34:48.726-07:00","post_time_friendly":"2 hours ago","depth":0,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":14},"current_revision":{"type":"revision","id":"763025_1","last_edit_author":{"type":"user","id":"273721","href":"/users/273721","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/273721","login":"splunker_ak"},"last_edit_time":"2026-08-20T04:34:48.726-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763025'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763025'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763025'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763025'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763025'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763025'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763025'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763025'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763025'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_topic_message","popularity":-2.43085,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763024","href":"/messages/763024","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-Upgrade-Heavy-Forwarder-and-Deployment-Master/m-p/763024#M24538","author":{"type":"user","id":"317951","href":"/users/317951","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/317951","login":"masonreed11"},"subject":"Re: Splunk Enterprise Upgrade Heavy Forwarder and Deployment Master server to latest version","search_snippet":"You should be able to upgrade directly only if Splunk’s 10.4.2 upgrade matrix lists your current versions as supported starting points. I’d check the official upgrade path and RHEL 9.8 compatibility ...","body":"
You should be able to upgrade directly only if Splunk’s 10.4.2 upgrade matrix lists your current versions as supported starting points. I’d check the official upgrade path and RHEL 9.8 compatibility first, especially for the 9.2.2 Heavy Forwarder. Take a backup and test in a non-production environment before upgrading production.
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762932","href":"/conversations/762932","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-Upgrade-Heavy-Forwarder-and-Deployment-Master/td-p/762932","style":"forum","thread_style":"forum","messages_count":5,"solved":false,"last_post_time":"2026-08-20T02:37:10.711-07:00","last_post_time_friendly":"4 hours ago"},"topic":{"type":"message","id":"762932","href":"/messages/762932","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-Upgrade-Heavy-Forwarder-and-Deployment-Master/m-p/762932#M24513"},"parent":{"type":"message","id":"762932","href":"/messages/762932","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-Upgrade-Heavy-Forwarder-and-Deployment-Master/m-p/762932#M24513"},"post_time":"2026-08-20T02:37:10.711-07:00","post_time_friendly":"4 hours ago","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":3},"current_revision":{"type":"revision","id":"763024_1","last_edit_author":{"type":"user","id":"317951","href":"/users/317951","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/317951","login":"masonreed11"},"last_edit_time":"2026-08-20T02:37:10.711-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763024'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763024'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763024'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763024'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763024'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763024'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763024'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763024'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763024'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-4.391412222222222,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763023","href":"/messages/763023","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/m-p/763023#M4301","author":{"type":"user","id":"318387","href":"/users/318387","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/318387","login":"Magidi"},"subject":"Re: Trial splunk>client Login issues","search_snippet":"Ok. How do I reset my password without calling? Is there no self service I can use on my trial account?","body":"Ok. How do I reset my password without calling? Is there no self service I can use on my trial account?
","teaser":"","board":{"type":"board","id":"core-splunk-cloud","href":"/boards/core-splunk-cloud","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/bd-p/core-splunk-cloud"},"conversation":{"type":"conversation","id":"763016","href":"/conversations/763016","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/td-p/763016","style":"forum","thread_style":"forum","messages_count":3,"solved":false,"last_post_time":"2026-08-20T01:19:49.438-07:00","last_post_time_friendly":"6 hours ago"},"topic":{"type":"message","id":"763016","href":"/messages/763016","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/m-p/763016#M4299"},"parent":{"type":"message","id":"763016","href":"/messages/763016","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/m-p/763016#M4299"},"post_time":"2026-08-20T01:19:49.438-07:00","post_time_friendly":"6 hours ago","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":13},"current_revision":{"type":"revision","id":"763023_1","last_edit_author":{"type":"user","id":"318387","href":"/users/318387","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/318387","login":"Magidi"},"last_edit_time":"2026-08-20T01:19:49.438-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763023'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763023'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763023'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763023'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763023'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763023'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763023'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763023'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763023'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-5.680656388888889,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763022","href":"/messages/763022","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/m-p/763022#M4300","author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"subject":"Re: Trial splunk>client Login issues","search_snippet":"Hi @Magidi Typically incorrect password 5 times in 5 minutes will trigger an account lockout. This is usually for 30 minutes. Please try again after the cooling off period and see if you ...","body":"Hi @Magidi
Typically incorrect password 5 times in 5 minutes will trigger an account lockout. This is usually for 30 minutes. Please try again after the cooling off period and see if you can get in. If you’re still having issues I would recommend calling Splunk Support using your local Splunk support contact number (as trial stack won’t give you web support) and explain to them.
for more info check out https://help.splunk.com/en/splunk-cloud-platform/administer/manage-users-and-security/9.3.2408/manage-credentials-and-keys/configure-splunk-password-policies
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"core-splunk-cloud","href":"/boards/core-splunk-cloud","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/bd-p/core-splunk-cloud"},"conversation":{"type":"conversation","id":"763016","href":"/conversations/763016","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/td-p/763016","style":"forum","thread_style":"forum","messages_count":3,"solved":false,"last_post_time":"2026-08-20T01:19:49.438-07:00","last_post_time_friendly":"6 hours ago"},"topic":{"type":"message","id":"763016","href":"/messages/763016","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/m-p/763016#M4299"},"parent":{"type":"message","id":"763016","href":"/messages/763016","view_href":"https://community.splunk.com/t5/Splunk-Cloud-Platform/Trial-splunk-gt-client-Login-issues/m-p/763016#M4299"},"post_time":"2026-08-20T01:11:48.900-07:00","post_time_friendly":"6 hours ago","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":19},"current_revision":{"type":"revision","id":"763022_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-20T01:11:48.900-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763022'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763022'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763022'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763022'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763022'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763022'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763022'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763022'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763022'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-5.814141944444445,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763021","href":"/messages/763021","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/m-p/763021#M24537","author":{"type":"user","id":"161352","href":"/users/161352","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/161352","login":"gcusello"},"subject":"Re: Universal Forwarder: mgmt port 8089 never binds on Proxmox/KVM, but full Splunk instances on the same host work fine","search_snippet":"Hi @SplunkExplorer , we encountered a probably similar issue upgrading a Splunk infrastructure from v.7 to 7.10. So on the DS we had to maintain version 9 for this reason: https://splunk...","body":"
Hi @SplunkExplorer ,
we encountered a probably similar issue upgrading a Splunk infrastructure from v.7 to 7.10.
So on the DS we had to maintain version 9 for this reason:
maybe it's something similar to your issue.
Ciao.
Giuseppe
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762992","href":"/conversations/762992","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/td-p/762992","style":"forum","thread_style":"forum","messages_count":4,"solved":false,"last_post_time":"2026-08-20T00:39:39.901-07:00","last_post_time_friendly":"6 hours ago"},"topic":{"type":"message","id":"762992","href":"/messages/762992","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/m-p/762992#M24524"},"parent":{"type":"message","id":"763019","href":"/messages/763019","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/m-p/763019#M24536"},"post_time":"2026-08-20T00:39:39.901-07:00","post_time_friendly":"6 hours ago","depth":3,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":7},"current_revision":{"type":"revision","id":"763021_1","last_edit_author":{"type":"user","id":"161352","href":"/users/161352","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/161352","login":"gcusello"},"last_edit_time":"2026-08-20T00:39:39.901-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763021'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763021'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763021'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763021'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763021'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763021'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763021'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763021'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763021'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-6.349978055555556,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763020","href":"/messages/763020","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/m-p/763020#M120798","author":{"type":"user","id":"161352","href":"/users/161352","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/161352","login":"gcusello"},"subject":"Re: How to collect logs from Informatica public APIs ?","search_snippet":"Hi @amirahmed , as @livehybrid pointed on, there isn't any add-on on Splunkbase for Informatica IDMC, this means that you have to create a custom add-on, that I h...","body":"Hi @amirahmed ,
as @livehybrid pointed on, there isn't any add-on on Splunkbase for Informatica IDMC, this means that you have to create a custom add-on, that I hint to publish on Splunkbase for the other users.
So the first step is to understand which data can you extract from your system for your scopes but at first you should define the perimeter of your job:
I'd like to say: extract all the data, but probably you need only a subset of them.
After this first step, you should identify the Splunk Data Models where storing these data and the data structure to extract (fields, values, etc...).
At least the way to extract these data.
Probably the creation od python scripts that use REST API is the best solution, also using the splunk features to encrypt account credentials.
To do this last step, as @livehybrid hinted, you should at first create the scripts and then package them in an add-on using Add-On Builder, in this way you'll have a well packaged add-on with a correct normalization for use in Splunk.
Ciao.
Giuseppe
","teaser":"","board":{"type":"board","id":"getting-data-in","href":"/boards/getting-data-in","view_href":"https://community.splunk.com/t5/Getting-Data-In/bd-p/getting-data-in"},"conversation":{"type":"conversation","id":"762989","href":"/conversations/762989","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/td-p/762989","style":"forum","thread_style":"forum","messages_count":3,"solved":false,"last_post_time":"2026-08-19T23:53:44.431-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762989","href":"/messages/762989","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/m-p/762989#M120792"},"parent":{"type":"message","id":"763006","href":"/messages/763006","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/m-p/763006#M120795"},"post_time":"2026-08-19T23:53:44.431-07:00","post_time_friendly":"yesterday","depth":2,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":8},"current_revision":{"type":"revision","id":"763020_1","last_edit_author":{"type":"user","id":"161352","href":"/users/161352","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/161352","login":"gcusello"},"last_edit_time":"2026-08-19T23:53:44.431-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763020'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763020'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763020'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763020'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763020'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763020'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763020'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763020'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763020'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-7.115388888888889,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763019","href":"/messages/763019","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/m-p/763019#M24536","author":{"type":"user","id":"249714","href":"/users/249714","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/249714","login":"SplunkExplorer"},"subject":"Re: Universal Forwarder: mgmt port 8089 never binds on Proxmox/KVM, but full Splunk instances on the same host work fine","search_snippet":"You are right rick, and indeed I modified web.conf and, of courses, retstarted the UF; but it does not works.","body":"You are right rick, and indeed I modified web.conf and, of courses, retstarted the UF; but it does not works.
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762992","href":"/conversations/762992","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/td-p/762992","style":"forum","thread_style":"forum","messages_count":4,"solved":false,"last_post_time":"2026-08-20T00:39:39.901-07:00","last_post_time_friendly":"6 hours ago"},"topic":{"type":"message","id":"762992","href":"/messages/762992","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/m-p/762992#M24524"},"parent":{"type":"message","id":"762994","href":"/messages/762994","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Universal-Forwarder-mgmt-port-8089-never-binds-on-Proxmox-KVM/m-p/762994#M24525"},"post_time":"2026-08-19T23:51:54.623-07:00","post_time_friendly":"yesterday","depth":2,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":16},"current_revision":{"type":"revision","id":"763019_1","last_edit_author":{"type":"user","id":"249714","href":"/users/249714","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/249714","login":"SplunkExplorer"},"last_edit_time":"2026-08-19T23:51:54.623-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763019'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763019'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763019'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763019'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763019'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763019'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763019'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763019'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763019'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-7.145892777777778,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763018","href":"/messages/763018","view_href":"https://community.splunk.com/t5/Share-a-Tip/Unable-to-edit-notable-comments-in-incident-review/td-p/763018","author":{"type":"user","id":"312895","href":"/users/312895","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/312895","login":"maheshnc"},"subject":"Unable to edit notable comments in incident review","search_snippet":"In splunk ES, a user is unable to edit/delete comments for most of the notables in incident review, however the same user is able to edit the comment for only one notable, if someone Is awa...","body":"In splunk ES, a user is unable to edit/delete comments for most of the notables in incident review, however the same user is able to edit the comment for only one notable, if someone Is aware of such scenarios please assist.
","teaser":"","board":{"type":"board","id":"share-tip","href":"/boards/share-tip","view_href":"https://community.splunk.com/t5/Share-a-Tip/bd-p/share-tip"},"conversation":{"type":"conversation","id":"763018","href":"/conversations/763018","view_href":"https://community.splunk.com/t5/Share-a-Tip/Unable-to-edit-notable-comments-in-incident-review/td-p/763018","style":"forum","thread_style":"forum","messages_count":1,"solved":false,"last_post_time":"2026-08-19T23:38:31.340-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"763018","href":"/messages/763018","view_href":"https://community.splunk.com/t5/Share-a-Tip/Unable-to-edit-notable-comments-in-incident-review/m-p/763018#M188"},"post_time":"2026-08-19T23:38:31.340-07:00","post_time_friendly":"yesterday","depth":0,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":15},"current_revision":{"type":"revision","id":"763018_1","last_edit_author":{"type":"user","id":"312895","href":"/users/312895","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/312895","login":"maheshnc"},"last_edit_time":"2026-08-19T23:38:31.340-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763018'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763018'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763018'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763018'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763018'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763018'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763018'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763018'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763018'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_topic_message","popularity":-7.369028611111111,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763017","href":"/messages/763017","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/m-p/763017#M24535","author":{"type":"user","id":"128674","href":"/users/128674","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/128674","login":"benkummer"},"subject":"Re: Splunk sends hostname in SAML Request","search_snippet":"Hi @livehybrid , thank you very much that worked. In my configuration this value was the url to the metatada of the IDP before. Cheers, Ben","body":"Hi @livehybrid ,
thank you very much that worked.
In my configuration this value was the url to the metatada of the IDP before.
Cheers,
Ben
Good day.
I am unable to login to my trial splunk > cloud. It says login failed.
I dont know how to reset my password.
I only managed to login for a couple of minutes then it started showing me this
Please assist.
\"
Note: The new modern navigation experience for the Splunk platform cannot be reverted to the previous UI. This design aligns with Cisco’s current user experience standards and is part of an ongoing effort to provide a consistent, modern interface across Cisco products.
\"
Thanks @Happy_16 - is that anywhere in the documentation?
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762808","href":"/conversations/762808","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/new-timeline-chart-in-10-4-how-to-assign-a-colour-to-a-category/td-p/762808","style":"forum","thread_style":"forum","messages_count":3,"solved":false,"last_post_time":"2026-08-19T18:03:44.194-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762808","href":"/messages/762808","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/new-timeline-chart-in-10-4-how-to-assign-a-colour-to-a-category/m-p/762808#M24501"},"parent":{"type":"message","id":"762808","href":"/messages/762808","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/new-timeline-chart-in-10-4-how-to-assign-a-colour-to-a-category/m-p/762808#M24501"},"post_time":"2026-08-19T18:03:44.194-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":13},"current_revision":{"type":"revision","id":"763012_1","last_edit_author":{"type":"user","id":"276092","href":"/users/276092","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/276092","login":"Andre_"},"last_edit_time":"2026-08-19T18:03:44.194-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763012'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763012'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763012'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763012'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763012'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763012'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763012'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763012'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763012'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-12.9488025,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763011","href":"/messages/763011","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Blank-host-in-license-usage-log-showing-100GB-daily-usage-Is/td-p/763011","author":{"type":"user","id":"318393","href":"/users/318393","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/318393","login":"sakib"},"subject":"Blank host in license_usage.log showing 100GB+ daily usage. Is this normal squashing behavior?","search_snippet":"Hi everyone, I am currently investigating a sudden Splunk license usage spike. When looking at my license metrics using SPL: index=\"_internal\" source=\"*license_usage.log\" type=Usage | stats sum(b)...","body":"Hi everyone,
I am currently investigating a sudden Splunk license usage spike. When looking at my license metrics using SPL:
index=\"_internal\" source=\"*license_usage.log\" type=Usage
| stats sum(b) as bytes by h, s, st
| eval gb = round(bytes/1024/1024/1024, 2)
| rename h as host, s as source, st as sourcetype
| sort - gb
I noticed a row where the host field is, one of the host is blank/empty, but it is consuming over 100 GB of license data per day.
I read a community post mentioning: \"The reason for blank host (field 'h') or sourcetype (st)/source(s) is due to squashing in license logs.\"
Questions for the community:
1. Is it normal for a squashed entry to represent such a massive volume (100+ GB)?
2. If the License Manager has squashed the host field to conserve memory, what is the best strategy or alternative SPL query to find out which actual backend host(s) are sending this specific data?
Hi @rjoijode
Try the following search - replacing the dashboard_1/2 values as required. The cumulative_run_time_sec will give you the total search time for that dashboard in the selected time period - which means if the dashboard is rendered twice then this will show both times.
index=_audit action=search info=completed provenance=\"UI:Dashboard:*\"\n| eval dashboard_name=case(\n like(provenance, \"%dashboard_1%\"), \"Dashboard 1 (Multiple Searches)\",\n like(provenance, \"%dashboard_2%\"), \"Dashboard 2 (Base Search)\",\n 1=1, \"Other\"\n)\n| where dashboard_name!=\"Other\"\n| stats \n count as total_search_jobs,\n sum(total_run_time) as cumulative_run_time_sec,\n avg(total_run_time) as avg_job_run_time_sec,\n sum(scan_count) as total_scanned_events,\n sum(result_count) as total_returned_results\n by dashboard_name\n| eval cumulative_run_time_sec=round(cumulative_run_time_sec, 2), avg_job_run_time_sec=round(avg_job_run_time_sec, 2)\n| table dashboard_name total_search_jobs cumulative_run_time_sec avg_job_run_time_sec total_scanned_events total_returned_results
If you want the *last* invocation you could try:
index=_audit action=search info=completed provenance=\"UI:Dashboard:*\"\n| eval dashboard_name=case(\n like(provenance, \"%dashboard_1%\"), \"Dashboard 1 (Multiple Searches)\",\n like(provenance, \"%dashboard_2%\"), \"Dashboard 2 (Base Search)\",\n 1=1, \"Other\"\n)\n| where dashboard_name!=\"Other\"\n| rex mode=sed field=search_id \"s/_\\d+\\.\\d+\\'?$//\"\n| dedup search_id\n| stats \n count as total_search_jobs,\n sum(total_run_time) as cumulative_run_time_sec,\n avg(total_run_time) as avg_job_run_time_sec,\n sum(scan_count) as total_scanned_events,\n sum(result_count) as total_returned_results\n by dashboard_name\n| eval cumulative_run_time_sec=round(cumulative_run_time_sec, 2), avg_job_run_time_sec=round(avg_job_run_time_sec, 2)\n| table dashboard_name total_search_jobs cumulative_run_time_sec avg_job_run_time_sec total_scanned_events total_returned_results
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762988","href":"/conversations/762988","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/To-verify-the-Performance-ensure-the-Base-search-Dashboard/td-p/762988","style":"forum","thread_style":"forum","messages_count":2,"solved":false,"last_post_time":"2026-08-19T12:23:12.159-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762988","href":"/messages/762988","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/To-verify-the-Performance-ensure-the-Base-search-Dashboard/m-p/762988#M24522"},"parent":{"type":"message","id":"762988","href":"/messages/762988","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/To-verify-the-Performance-ensure-the-Base-search-Dashboard/m-p/762988#M24522"},"post_time":"2026-08-19T12:23:12.159-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":22},"current_revision":{"type":"revision","id":"763009_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-19T12:23:12.159-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763009'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763009'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763009'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763009'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763009'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763009'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763009'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763009'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763009'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-18.624371944444444,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763008","href":"/messages/763008","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/m-p/763008#M120797","author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"subject":"Re: OTel GenAI spans blowing up my index - separate index or keep with APM?","search_snippet":"You could also look at adjusting the index using your Otel configuration - see https://community.splunk.com/t5/Community-Blog/Routing-logs-with-Splunk-OTel-Collector-for-Kubernetes/ba-p/683190#:...","body":"You could also look at adjusting the index using your Otel configuration - see https://community.splunk.com/t5/Community-Blog/Routing-logs-with-Splunk-OTel-Collector-for-Kubernetes/ba-p/683190#:~:text=Today%20I'll%20show%20you%20how%20to%20create,how%20we%20can%20do%20it%20in%20SOCK. for more info
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"getting-data-in","href":"/boards/getting-data-in","view_href":"https://community.splunk.com/t5/Getting-Data-In/bd-p/getting-data-in"},"conversation":{"type":"conversation","id":"762919","href":"/conversations/762919","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/td-p/762919","style":"forum","thread_style":"forum","messages_count":5,"solved":false,"last_post_time":"2026-08-19T12:08:14.084-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762919","href":"/messages/762919","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/m-p/762919#M120781"},"parent":{"type":"message","id":"762919","href":"/messages/762919","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/m-p/762919#M120781"},"post_time":"2026-08-19T12:08:14.084-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":16},"current_revision":{"type":"revision","id":"763008_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-19T12:08:14.084-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763008'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763008'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763008'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763008'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763008'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763008'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763008'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763008'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763008'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-18.873839444444446,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763007","href":"/messages/763007","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/m-p/763007#M120796","author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"subject":"Re: OTel GenAI spans blowing up my index - separate index or keep with APM?","search_snippet":"Hi @shvra I would use props/transforms to pivot it based on sourcetype/source/regex (if needed) into a separate index(es) with different retention as required depending on the data, you c...","body":"Hi @shvra
I would use props/transforms to pivot it based on sourcetype/source/regex (if needed) into a separate index(es) with different retention as required depending on the data, you could also apply other INGEST_EVAL that you need along the way if you need to redact anything or strip certain data out.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"getting-data-in","href":"/boards/getting-data-in","view_href":"https://community.splunk.com/t5/Getting-Data-In/bd-p/getting-data-in"},"conversation":{"type":"conversation","id":"762919","href":"/conversations/762919","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/td-p/762919","style":"forum","thread_style":"forum","messages_count":5,"solved":false,"last_post_time":"2026-08-19T12:08:14.084-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762919","href":"/messages/762919","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/m-p/762919#M120781"},"parent":{"type":"message","id":"762919","href":"/messages/762919","view_href":"https://community.splunk.com/t5/Getting-Data-In/OTel-GenAI-spans-blowing-up-my-index-separate-index-or-keep-with/m-p/762919#M120781"},"post_time":"2026-08-19T12:03:53.235-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":18},"current_revision":{"type":"revision","id":"763007_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-19T12:03:53.235-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763007'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763007'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763007'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763007'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763007'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763007'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763007'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763007'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763007'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-18.946300277777777,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763006","href":"/messages/763006","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/m-p/763006#M120795","author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"subject":"Re: How to collect logs from Informatica public APIs ?","search_snippet":"Hi @amirahmed It doesnt look there is an existing Splunkbase app for Informatica logs to be pulled into Splunk, I would suggest looking at using AddOn Builder or UCC Framework to bui...","body":"Hi @amirahmed
It doesnt look there is an existing Splunkbase app for Informatica logs to be pulled into Splunk, I would suggest looking at using AddOn Builder or UCC Framework to build a custom app to ingest this (typical Python input) or you may be able to use the REST API Modular Input or WebTools Add-On to run curl-type requests with a custom command to poll the data - but creating a custom app would typically be the preferred route.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"getting-data-in","href":"/boards/getting-data-in","view_href":"https://community.splunk.com/t5/Getting-Data-In/bd-p/getting-data-in"},"conversation":{"type":"conversation","id":"762989","href":"/conversations/762989","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/td-p/762989","style":"forum","thread_style":"forum","messages_count":3,"solved":false,"last_post_time":"2026-08-19T23:53:44.431-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762989","href":"/messages/762989","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/m-p/762989#M120792"},"parent":{"type":"message","id":"762989","href":"/messages/762989","view_href":"https://community.splunk.com/t5/Getting-Data-In/How-to-collect-logs-from-Informatica-public-APIs/m-p/762989#M120792"},"post_time":"2026-08-19T11:51:17.009-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":24},"current_revision":{"type":"revision","id":"763006_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-19T11:51:17.009-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763006'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763006'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763006'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763006'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763006'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763006'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763006'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763006'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763006'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":0.010276339020789012,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763005","href":"/messages/763005","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Does-Splunk-Enterprise-On-Prem-provide-native-encryption-at-rest/m-p/763005#M24530","author":{"type":"user","id":"213957","href":"/users/213957","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/213957","login":"richgalloway"},"subject":"Re: Does Splunk Enterprise On-Prem provide native encryption at rest for locally stored indexed data?","search_snippet":"Splunk Enterprise NOT provide native encryption at rest for indexed data stored locally. There is no documentation of that just as there is no documentation for the many other features Splunk d...","body":"Splunk Enterprise NOT provide native encryption at rest for indexed data stored locally. There is no documentation of that just as there is no documentation for the many other features Splunk does not provide.
Splunk does not offer a recommended means for at-rest encryption. That's up to each customer based on their requirements and capabilities.
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762996","href":"/conversations/762996","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Does-Splunk-Enterprise-On-Prem-provide-native-encryption-at-rest/td-p/762996","style":"forum","thread_style":"forum","messages_count":2,"solved":false,"last_post_time":"2026-08-19T11:45:07.295-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762996","href":"/messages/762996","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Does-Splunk-Enterprise-On-Prem-provide-native-encryption-at-rest/m-p/762996#M24527"},"parent":{"type":"message","id":"762996","href":"/messages/762996","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Does-Splunk-Enterprise-On-Prem-provide-native-encryption-at-rest/m-p/762996#M24527"},"post_time":"2026-08-19T11:45:07.295-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":21},"current_revision":{"type":"revision","id":"763005_1","last_edit_author":{"type":"user","id":"213957","href":"/users/213957","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/213957","login":"richgalloway"},"last_edit_time":"2026-08-19T11:45:07.295-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763005'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763005'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763005'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763005'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763005'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763005'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763005'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763005'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763005'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":0.010201962780302236,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763004","href":"/messages/763004","view_href":"https://community.splunk.com/t5/Getting-Data-In/Smartstore-SignatureDoesNotMatch-Error/m-p/763004#M120794","author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"subject":"Re: Smartstore SignatureDoesNotMatch Error","search_snippet":"Hi @prad87 The SignatureDoesNotMatch error with Dell S3-compatible storage could be due to the configuraiton/support of signature versions in the Dell System, I would suggest try setting ...","body":"Hi @prad87
The SignatureDoesNotMatch error with Dell S3-compatible storage could be due to the configuraiton/support of signature versions in the Dell System, I would suggest try setting Splunk to use v2 instead of the default v4 signature.
Add the following to your indexes.conf:
[volume:remote_store]
remote.s3.signature_version = v2\nremote.s3.url_version = v1
The url_version = v1 setting must be set when signature_version = v2
Once done restart Splunk.
For more info check out indexes.conf - remote.s3.signature_version
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"getting-data-in","href":"/boards/getting-data-in","view_href":"https://community.splunk.com/t5/Getting-Data-In/bd-p/getting-data-in"},"conversation":{"type":"conversation","id":"762993","href":"/conversations/762993","view_href":"https://community.splunk.com/t5/Getting-Data-In/Smartstore-SignatureDoesNotMatch-Error/td-p/762993","style":"forum","thread_style":"forum","messages_count":2,"solved":false,"last_post_time":"2026-08-19T11:44:45.563-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762993","href":"/messages/762993","view_href":"https://community.splunk.com/t5/Getting-Data-In/Smartstore-SignatureDoesNotMatch-Error/m-p/762993#M120793"},"parent":{"type":"message","id":"762993","href":"/messages/762993","view_href":"https://community.splunk.com/t5/Getting-Data-In/Smartstore-SignatureDoesNotMatch-Error/m-p/762993#M120793"},"post_time":"2026-08-19T11:44:45.563-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":15},"current_revision":{"type":"revision","id":"763004_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-19T11:44:45.563-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763004'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763004'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763004'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763004'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763004'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763004'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763004'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763004'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763004'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_reply_message","popularity":-19.265105555555557,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"763003","href":"/messages/763003","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/m-p/763003#M24529","author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"subject":"Re: Splunk sends hostname in SAML Request","search_snippet":"Hi @benkummer I would try and set the entityId value in the saml configuration of authentication.conf (see https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/c...","body":"Hi @benkummer
I would try and set the entityId value in the saml configuration of authentication.conf (see https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/authentication.conf#:~:text=changeme%0AattributeQuerySoapUsername%20%3D%20test-,entityId,-%3D%20test%2Dsplunk%0AidpAttributeQueryUrl)
[samlv2]\nentityId = yourServerNameWithoutNumericalPrefix🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762997","href":"/conversations/762997","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/td-p/762997","style":"forum","thread_style":"forum","messages_count":3,"solved":true,"last_post_time":"2026-08-19T23:36:39.746-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762997","href":"/messages/762997","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/m-p/762997#M24528"},"parent":{"type":"message","id":"762997","href":"/messages/762997","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/m-p/762997#M24528"},"post_time":"2026-08-19T11:33:53.981-07:00","post_time_friendly":"yesterday","depth":1,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":true,"solution_data":{"type":"solution_data","message_id":"763003","accepter":{"type":"user","id":"128674","href":"/users/128674","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/128674","login":"benkummer"},"time":"2026-08-19T23:36:54.000-07:00"},"metrics":{"type":"message_metrics","views":24},"current_revision":{"type":"revision","id":"763003_1","last_edit_author":{"type":"user","id":"170906","href":"/users/170906","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/170906","login":"livehybrid"},"last_edit_time":"2026-08-19T11:33:53.981-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '763003'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '763003'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '763003'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '763003'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '763003'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '763003'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '763003'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '763003'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '763003'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"accepted_solution_message","popularity":0.010068793303386133,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false},{"type":"message","id":"762840","href":"/messages/762840","view_href":"https://community.splunk.com/t5/Community-Blog/Defend-at-Machine-Speed-Your-Guide-to-Security-Sessions-at/ba-p/762840","author":{"type":"user","id":"251079","href":"/users/251079","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/251079","login":"loriexi"},"subject":"Defend at Machine Speed: Your Guide to Security Sessions at .conf26","search_snippet":"Splunk .conf26 \n \n With threats moving at machine speed and attack surfaces expanding across hybrid environments, modern security operations can no longer rely on \"business as usual.\" At .conf26, w...","body":"![\"Splunk](\"https://community.splunk.com/t5/image/serverpage/image-id/42484iCF06590E0E039119/image-size/large?v=v2&px=999\" "\\"04_38_49.jpg\\"")
\n
With threats moving at machine speed and attack surfaces expanding across hybrid environments, modern security operations can no longer rely on \"business as usual.\" At .conf26, we’ve structured our learning experiences around real-world outcomes to help you defend at machine speed, unifying your SOC and infrastructure, accelerating threat detection, and unlocking trusted, autonomous response.
\nWhether you’re exploring the shift toward an Agentic SOC, defending against emerging AI/ML threats, or building resilient detection-as-code pipelines, our hand-picked breakout sessions provide practical, actionable blueprints. From interactive workshops and technical deep dives to peer-led customer panels, explore the sessions below to map out your schedule and maximize your security potential in Denver.
\nExplore the sessions below and add your favorites to your schedule to make the most of your .conf26 experience!
\n[Tuesday], [Sep 15] | [10:30AM – 11:15AM] [MDT]
\nIn a landscape where threats move at machine speed, \"business as usual\" is no longer an option for the modern SOC. Security leaders are under immense pressure to consolidate tools, leverage AI responsibly, and demonstrate clear ROI. In this session, we pull back the curtain on the latest advancements within the Splunk Security portfolio. We will explore the shift toward the Agentic SOC—where AI doesn't just assist but actively orchestrates triage and investigation workflows.
\nSession Format: Technical Session (recorded on-site and published to .conf Online post-event)
\n[Tuesday], [Sep 15] | [1:00PM – 1:45PM] [MDT]
\nJoin Brandon Parks (Director, Information Security) and Neal Iyer (Director, Product Management) to discuss Splunk SOC's AI transformation journey as customer zero for Splunk's security products. Get a sneak peek at bleeding edge areas of innovation that Splunk's product and SOC teams are piloting for the Agentic SOC.
\nSession Format: Technical Session (recorded on-site and published to .conf Online post-event)
\n[Wednesday], [Sep 16] | [2:00 PM – 3:00 PM] [MDT]
\nSecurity incidents are inevitable, but operational failure isn’t. Effective response hinges on deep asset intelligence, accurate context to identify systems, owners, and priorities. In this session you will hear from our customer (Devon Energy) their lessons in common cyber resilience barriers: fragmented inventories, coverage gaps, asset drift, and hybrid visibility issues with Splunk Exposure Analytics.
\nSession Format: Panel Discussion (New for .conf26; recorded on-site and published to .conf Online post-event)
\n[Tuesday], [Sep 15] | [12:00PM – 12:20PM] [MDT]
\nLearn about upcoming AI innovations across Threat Detection, Investigation and Response workflows in Splunk Security Products including Splunk Enterprise Security Essentials and Splunk Enterprise Security Premier
\nSession Format: Theater Session (not recorded)
\n[Wednesday], [Sep 16] | [3:30PM – 3:50PM] [MDT]
\nLearn how Splunk’s Threat Intelligence capabilities and Cisco Talos are fully embedded into every stage of a TDIR workflow within ES so analysts can reduce alert fatigue, improve accuracy, and make faster, more confident decisions. We'll walk through how to tap into the knowledge of the Splunk Threat Research team and how analysts can integrate top-tier detections into their security posture — without needing to build them from scratch.
\nSession Format: Theater Session (not recorded)
[Tuesday], [Sep 15] | [2:30PM – 3:30PM] [MDT]
\nReady to see what Splunk ES Premier can really do? Join our advanced customer panel as they deconstruct their most sophisticated SecOps workflows. From using the new agentic capabilities to automating forensic analysis to orchestrating autonomous response playbooks that neutralize lateral movement in seconds—this is a deep dive into the \"Premier\" experience. No entry-level overviews here; just raw, technical use cases from the world’s most resilient SOCs.
\nSession Format: Panel Discussion (New for .conf26; recorded on-site and published to .conf Online post-event)
\n[Wednesday], [Sep 16] | [9:00AM – 10:00AM] [MDT]
\nPhishing investigations often stop at analyzing the email, missing what users do next. In this interactive workshop, attendees will investigate real-world phishing scenarios by combining Automated Threat Analysis with UEBA to correlate email artifacts with user behavior. Participants will build attack timelines, identify compromised users, and detect early signs of data exfiltration using proxy, identity, and endpoint telemetry.
\nSession Format: Interactive Workshop Session (Live recording will be published on-demand via .conf Online exclusively for session attendees)
\n[Wednesday], [Sep 16] | [9:00AM – 11:00AM] [MDT]
\nLet's get ready to automate! The Automation Games provides a peek into how automation and orchestration in Splunk® SOAR help security teams eliminate repetitive tasks, accelerate incident response, and boost efficiency. In this interactive session, participants will compete with peers and use the AI Playbook Assistant to build and refine playbooks in real time.
\nSession Format: Interactive Workshop Session (Live recording will be published on-demand via .conf Online exclusively for session attendees)
\n[Wednesday], [Sep 16] | [12:30PM – 1:30PM] [MDT]
\nBrought to you by the experts behind SnapAttack - in this hands-on workshop, you'll learn how Detection Studio provides the complete detection lifecycle experience within Splunk Enterprise Security. You'll see how detection engineers can seamlessly plan, develop, test, deploy and monitor detections to enable faster mean-time-to-detect and deploy detections with confidence.
\nSession Format: Interactive Workshop Session (Live recording will be published on-demand via .conf Online exclusively for session attendees)
\n[Wednesday], [Sep 16] | [10:30AM – 10:50AM] [MDT]
\nAI agents are becoming autonomous actors on your network. This session explores how agents behave when simulating real workflows, how to collect and baseline their telemetry, and what distinguishes agent behavior from human interaction. We examine patterns that separate benign automation from misconfiguration and suspicious activity, leaving attendees with a practical framework for detecting and responding to agent-driven threats in the agentic era.
\nSession Format: Theater Session (not recorded)
\n[Wednesday], [Sep 16] | [2:30PM – 2:50PM] [MDT]
\nMITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the AI equivalent of ATT&CK. Most Splunk deployments have zero detection coverage for large language model (LLM) threats. This session covers 10 production SPL detection rules mapped to specific ATLAS techniques including prompt injection, jailbreak attempts, model reconnaissance, and training data poisoning. Participants will leave with deployable rules and the data requirements needed to run them.
\nSession Format: Theater Session (not recorded)
\n[Wednesday], [Sep 16] | [4:00PM – 5:00PM] [MDT]
\nIn this session, we demonstrate how the Cisco PEAK Assistant framework combined with the Splunk MCP Server creates an automated pipeline for building, testing, and deploying detections at scale. See how PEAK Assistant acts as the \"brain\" of the detection lifecycle– using its agentic capabilities to reason about threat intelligence, map behaviors to MITRE ATT&CK, and generate Splunk SPL detections.
\nSession Format: Interactive Workshop Session (Live recording will be published on-demand via .conf Online exclusively for session attendees)
\n[Wednesday], [Sep16] | [4:15PM – 5:00PM] [MDT]
\nTraditional SOCs miss physical OT/ICS constraints. This session integrates Sat-Ark, a deterministic defense architecture, into Splunk to stop SCADA sensor spoofing and kinetic state-desync. We will demonstrate ingesting raw PLC telemetry to build graph-based correlation rules. By cross-checking sensor channels, Splunk triggers automated safe-state holds before physical damage occurs. Includes a simulated demo mapping SWaT datasets to catch anomalies that threshold-based alerts miss.
\nSession Format: Technical Session (recorded on-site and published to .conf Online post-event)
\n\n
Ready to sharpen your skills, test hands-on playbooks, and secure your environment against modern threats? Don't wait until you arrive in Denver! Secure your pass today, explore the catalog, and add these can't-miss security sessions to your official .conf26 agenda.
\n🛡️ Lock in your pass for Splunk .conf26 and build your schedule!
\n\n
If you’re not subscribed, you’re probably missing something good. Fix that!
\n","teaser":"
In an era where cyber threats move faster than human response times, modern security teams must evolve from reactive triage to autonomous defense. At .conf26, our breakout sessions are built around real outcomes, helping you unify SOC operations, respond autonomously with trusted governance, and close visibility gaps across your entire attack surface. Explore our curated guide to technical sessions, hands-on workshops, and customer panels across Novice, Intermediate, and Advanced skill levels to start building your agenda today!
","seo_title":".conf26 Security Sessions: Agentic SOC, AI Threat Detection & Workshops","seo_description":"Plan your .conf26 security schedule! Explore hand-picked security breakout sessions, interactive workshops, customer panels, and AI threat detection deep dives.","board":{"type":"board","id":"Community-Blog","href":"/boards/Community-Blog","view_href":"https://community.splunk.com/t5/Community-Blog/bg-p/Community-Blog"},"conversation":{"type":"conversation","id":"762840","href":"/conversations/762840","view_href":"https://community.splunk.com/t5/Community-Blog/Defend-at-Machine-Speed-Your-Guide-to-Security-Sessions-at/ba-p/762840","style":"blog","thread_style":"blog","messages_count":1,"solved":false,"last_post_time":"2026-08-19T09:04:13.663-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762840","href":"/messages/762840","view_href":"https://community.splunk.com/t5/Community-Blog/Defend-at-Machine-Speed-Your-Guide-to-Security-Sessions-at/ba-p/762840"},"post_time":"2026-08-19T09:04:13.663-07:00","post_time_friendly":"yesterday","depth":0,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":44},"current_revision":{"type":"revision","id":"762840_3","last_edit_author":{"type":"user","id":"276129","href":"/users/276129","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/276129","login":"iamryan"},"last_edit_time":"2026-08-19T09:02:08.705-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '762840'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '762840'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '762840'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '762840'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '762840'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '762840'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '762840'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '762840'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '762840'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"blog_topic_message","popularity":-21.940648888888887,"excluded_from_kudos_leaderboards":false,"latest_version":{"type":"friendly_version","major":"1","minor":"0"},"include_hidden_messages":true,"content_workflow":{"type":"content_workflow","state":"publish","message_draft_history":{"query":"SELECT * FROM message_draft_history WHERE message.id = '762840'"},"user_context":{"type":"message_workflow_context","can_edit":false,"can_schedule":false},"view_href":"https://community.splunk.com/t5/blogs/blogworkflowpage/blog-id/Community-Blog/article-id/1107"},"is_promoted":false},{"type":"message","id":"762997","href":"/messages/762997","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/td-p/762997","author":{"type":"user","id":"128674","href":"/users/128674","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/128674","login":"benkummer"},"subject":"Splunk sends hostname in SAML Request","search_snippet":"We are configuring SAML Authentication in splunk. We set up everything but splunk sends an SAMLRequest starting with trailing number because the hostname of the system is 1ourhostname. ...","body":"We are configuring SAML Authentication in splunk.
We set up everything but splunk sends an SAMLRequest starting with trailing number because the hostname of the system is 1ourhostname.
<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<samlp:AuthnRequest ID=\"1ourhostname..1.6E4A85A3-6AC1-4CC3-A9
The id Provider rejects the request because an id starting with numbers is incorrect.
What i tried set fqdn to the web url in both server.conf general and in the saml secttion in authentication.conf . That does not change the saml request. Any ideas?
authentication.conf:
[saml]\n\nfqdn = splunk-test.system.local
server.conf:
[general]\nserverName=splunk-test.system.local\nfqdn = splunk-test.system.local
","teaser":"","board":{"type":"board","id":"core-splunk-enterprise","href":"/boards/core-splunk-enterprise","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/bd-p/core-splunk-enterprise"},"conversation":{"type":"conversation","id":"762997","href":"/conversations/762997","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/td-p/762997","style":"forum","thread_style":"forum","messages_count":3,"solved":true,"last_post_time":"2026-08-19T23:36:39.746-07:00","last_post_time_friendly":"yesterday"},"topic":{"type":"message","id":"762997","href":"/messages/762997","view_href":"https://community.splunk.com/t5/Splunk-Enterprise/Splunk-sends-hostname-in-SAML-Request/m-p/762997#M24528"},"post_time":"2026-08-19T07:47:07.312-07:00","post_time_friendly":"yesterday","depth":0,"read_only":false,"edit_frozen":false,"language":"EN","can_accept_solution":false,"placeholder":false,"is_solution":false,"solution_data":{},"metrics":{"type":"message_metrics","views":46},"current_revision":{"type":"revision","id":"762997_1","last_edit_author":{"type":"user","id":"128674","href":"/users/128674","view_href":"https://community.splunk.com/t5/user/viewprofilepage/user-id/128674","login":"benkummer"},"last_edit_time":"2026-08-19T07:47:07.312-07:00"},"kudos":{"query":"SELECT * FROM kudos WHERE message.id = '762997'"},"tags":{"query":"SELECT * FROM tags WHERE messages.id = '762997'"},"labels":{"query":"SELECT * FROM labels WHERE messages.id = '762997'"},"images":{"query":"SELECT * FROM images WHERE messages.id = '762997'"},"videos":{"query":"SELECT * FROM videos WHERE messages.id = '762997'"},"attachments":{"query":"SELECT * FROM attachments WHERE message.id = '762997'"},"replies":{"query":"SELECT * FROM messages WHERE parent.id = '762997'"},"ratings":{"query":"SELECT * FROM ratings WHERE message.id = '762997'"},"custom_tags":{"query":"SELECT * FROM custom_tags WHERE messages.id = '762997'"},"moderation_status":"approved","visibility_scope":"public","user_context":{"type":"user_context","kudo":false,"read":false,"can_reply":false,"can_kudo":false,"can_delete":false},"message_type":"forum_topic_message","popularity":-23.225748333333332,"excluded_from_kudos_leaderboards":false,"include_hidden_messages":true,"is_promoted":false}],"next_cursor":"MjYuNHwyLjB8aXwyNXw0MjowLDE1OjB8aW50LDc2MzAyNyw3NjI5OTc"},"metadata":{}}