What are some cool things you've implemented in your Splunk environment?

[aberkow]

This is information I'm always curious to know about other people's environments/setups.

Is there anything you're particularly proud of that you set up? Some super novel dashboard, or really innovative alert or way of thinking about how you've logged or ingested logs? I'm pretty aware of most of the ways in which we use Splunk, but know there's gotta be cool stuff out there I've never thought of.

Sorry if this question's been asked in a different form, I couldn't find a great example of it!

[woodcock]

In one project we rebuilt an ArcSight SIEM implementation completely in core Splunk.
In another project we completely rebuilt ITSI in core Splunk.
In another project we built a threshold setting/checking tool that used text fields as both input and output that tracked user changes and could revert the previous changes to a particular date (again, all in core Splunk).
As a personal exercise I rebuilt all of fail2ban in core Splunk.
We built a near-realtime Least-Cost-Routing tool back when VIOP was ex$pen$ive that saved our company hundreds of thousands of dollars every day.

[sajohnson6]

Happy New Year All..

Can you elaborate more on the rebuild of ArcSight SIEM implementation in core Splunk?