Community Blog
Get the latest updates on the Splunk Community, including member experiences, product education, events, and more!

Your Guide to SPL2 at .conf24!

Splunk Employee
Splunk Employee

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in mid-June in the desert. Hot.

You know what else is going to be hot at .conf24? Yup - SPL2. You’ll find a host of sessions about SPL2, or about the products that SPL2 is used in, this year at .conf - across both GDI and search! This year, you’ll see a lot of focus for SPL2 on two types of users: Splunk admins (including data admins who configure data ingestion rules), and Splunk app developers (including partners).


Remind me what SPL2 is, again?

Glad you asked! SPL2, Splunk’s next-generation data search and processing language, introduces consistency across batch & stream data preparation, as well as optional SQL syntax & programming concepts, to Splunk’s ultra-powerful SPL language. It is not only just a super-powerful query language (like SPL) that supports both SPL and SQL syntaxes, but it’s also a data preparation language that can be used in streaming products, while also introducing programming concepts (imports / exports, functions, types, views, etc.) that app developers will love.

SPL2 is available in 3 major products and features today:


SPL2 Tracks at .conf24

So, what sessions should you attend to see what SPL2 is all about, and how it can help you? It depends a bit on your role and your interests. But before we get to that: make sure you check out the SPL2 Overview Track below, which is a good primer to understand the foundations of SPL2, as well as hear from customers.

If you are an app developer or a partner that develops custom applications (for your customers or in-house), or an admin that customizes apps for local use, check out the SPL2 App Development Track below.

If you are a Splunk admin or consultant who deals with data inputs, onboarding data, and customizing data before it’s searchable - check out the SPL2 GDI Track below.


SPL2 Overview Track

These sessions are perfect primers for SPL2, across both GDI and app development!


SPL2 App Development Track

Now, let’s talk about SPL2 in Splunk Enterprise. App developers, partners, and admins: tune in, and add these to your agenda!


SPL2 GDI Track

And last but not least, let’s take a look at the GDI track - largely in the context of the new Data Mangement Experience (DMX), which includes Edge and Ingest Processor! Some of these sessions focus heavily on SPL2, and others focus on other important aspects of the feature or product. Sessions with a heavy SPL2 focus are notated with Large SPL2 focus!

  • Modernize Your GDI and Optimize Your Data with Splunk Data Management Experience (DMX)
    Wednesday, June 12, 2:00 - 2:45 PM

    Come and learn about how we are transforming Splunk's GDI experience with Data Management Experience (DMX) across the entire data lifecycle from data collection, edge and ingest processing, routing, monitoring and troubleshooting. Join us to understand the key pillars of Splunk GDI and DMX and how they all come together to deliver you a unified experience across the Splunk platform, observability and security product portfolio.

  • WORKSHOP: Zero to GDI Hero: Learning How To Filter, Mask, Route & Metricize Your Data with Ingest Pr...
    Thursday, June 13, 8:30 - 10:30 AM
    Large SPL2 focus!

    Dive into this hands-on lab that will show you how to quickly gain control of your data ecosystem to reduce costs, normalize fields and distribute data to the correct destinations. You can even metricize and route data to your Splunk Observability solutions - all on the fly, before landing at rest, with some help from the powerful SPL2 language.

  • SPL2 for DMX: A Practical Guide
    Thursday, June 13, 11:00 - 11:45 AM
    Large SPL2 focus!

    If you want to learn how to use SPL2 to author processor pipelines in Splunk's Data Management Experience (DMX), this is the session for you. You will gain the practical skills, knowledge and best practices of using SPL2 in DMX to effectively process your data.

  • PLA1880B - Accelerate Your Data Value with DMX New Data Processing Capability - Splunk® Ingest Proce...
    Thursday, June 13, 4:30 - 5:15 PM

    Want to optimize your data in a fully SaaS solution? In this session, we will show how new features in Splunk® Cloud Platform can convert logs to metrics for observability and even route to multiple destinations based on value. Learn how to extract monitoring metrics from your log data without indexing raw datasets. Come join us to discover the data processing capabilities delivered by the new Splunk® Ingest Processor, a fully Splunk-hosted and managed solution. Get ready to accelerate your data’s value!


See you there!

None of these sessions fit into your schedule? Want to chat more? Come say hi to us at the Builder Bar - we'll be there, ready to talk shop about SPL2!

We hope this helps you plan your time at .conf24 a bit better, whether you’re on the GDI track or app development track! See you in Vegas!

Got questions for the Splunk team?

Tags (3)
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...