Getting Data In: Platform (EMEA) - Wed 9/6/23

adepp — Mon, 11 Sep 2023 22:29:10 GMT

[EMEA-friendly: 8am PT / 4pm UK time] - Register here and ask questions below. This thread is for the Community Office Hours session on Getting Data In (GDI) to Splunk Platform on Wed, September 6, 2023 at 8am PT / 11am ET / 4pm UK time

This is your opportunity to ask questions related to your specific GDI challenge or use case, including:

How to onboard common data sources (AWS, Azure, Windows, *nix, etc.)
Using forwarders
Apps to get data in
Data Manager (Splunk Cloud Platform)
Ingest actions, archiving your data, and anything else you’d like to learn!

Please submit your questions at registration or as comments below. You can also head to the #office-hours user Slack channel to ask questions (request access here).

Pre-submitted questions will be prioritized. After that, we will go in order of the questions posted below, then will open the floor up to live Q&A with meeting participants. If there’s a quick answer available, we’ll post as a direct reply.

Look forward to connecting!

Re: Getting Data In: Platform (EMEA) - Wed 9/6/23

adepp — Mon, 11 Sep 2023 22:28:42 GMT

Here are a few questions from the session (get the full Q&A deck and live recording in the #office-hours Slack channel):

Q1: How to get a python script that run REST API calls to work with python3 on the HF in case python2 is withdrawn

How to make Python 2 compatible Splunk app a python 3 compatible

Rewrite app so that it’s Python 3 compatible only (e.g. in Splunk 9.x)
Rewrite app so that it’s “dual-compatible” to support both Python 2.x and Python 3.x.

Suggested for all developers
You can use Splunk provided dual-compatibility libraries: six, python-future, 2to3 (in this order)
Caveat - using libraries above might not help in all cases (manual fixes necessary)

Q2: In case we have a lot of scheduled saved searches and not so many adhoc what we can fine tune to not have the searches delayed?

Maximize search slots on SH - see Splunk .conf17 slide deck: https://conf.splunk.com/files/2017/slides/splunk-enterprise-security-health-check.pdf
Optimize SPL code
Optimize resource usage during indexing on IDX
Optimize resource usage during searching on IDX
Spread your scheduled searches over the time
Boost resources (CPU, RAM, IOPS) - Add more cores (both to SH and possibly to IDX) if you hit search-slots limit. Splunk reference server hardware specs.

Q3: Splunk Edge Processor - is it possible to both filter data A and send A' to Splunk Cloud and simultaneously send A to S3 bucket?

Yes. This is a standard use case and one that customers asked for. All data (A) goes to S3 (unfiltered) to be searched later only if necessary. And filtered (more relevant) data (A’) goes to Splunk Cloud.

Other Questions (check the #office-hours Slack channel for responses):

What are the different options to get data in?
Swift alliance log integration with Splunk. We were collecting the log from Swift application using SNMP V2 but is stopped.
Edge Processor demo
GDI resources for Observability (Azure, server less functions, K8 micro services, etc.)
Additional GDI resources (free courses, .conf sessions, tech talks, etc.)

rss.livelink.thread@place:occasion

Getting Data In: Platform (EMEA) - Wed 9/6/23

Re: Getting Data In: Platform (EMEA) - Wed 9/6/23