#Random
This is a place to discuss all things outside of Splunk, its products, and its use cases.

What is Santa bringing your Splunk instance?

jplumsdaine22
Influencer

We asked Santa to teach users to use the same timestamp format in every log file

Tags (1)
1 Solution

acharlieh
Influencer

Albeit fictitious and and possibly a little off due to the late hour, this seemed like the most appropriate answer:

On the first day of Splunk-mas my company gave to me
A money cannon for my next license.

On the second day of Splunk-mas my company gave to me
Two quick ref Cards,
And A money cannon for my next license.

On the third day of Splunk-mas my company gave to me
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the fourth day of Splunk-mas my company gave to me
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the fifth day of Splunk-mas my company gave to me
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the sixth day of Splunk-mas my company gave to me
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the seventh day of Splunk-mas my company gave to me
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the eighth day of Splunk-mas my company gave to me
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the ninth day of Splunk-mas my company gave to me
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the tenth day of Splunk-mas my company gave to me
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the eleventh day of Splunk-mas my company gave to me
Eleven virtual trainings,
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the twelfth day of Splunk-mas my company gave to me
Twelve Beefy Boxes,
Eleven virtual trainings,
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license!!!!

View solution in original post

acharlieh
Influencer

Albeit fictitious and and possibly a little off due to the late hour, this seemed like the most appropriate answer:

On the first day of Splunk-mas my company gave to me
A money cannon for my next license.

On the second day of Splunk-mas my company gave to me
Two quick ref Cards,
And A money cannon for my next license.

On the third day of Splunk-mas my company gave to me
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the fourth day of Splunk-mas my company gave to me
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the fifth day of Splunk-mas my company gave to me
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the sixth day of Splunk-mas my company gave to me
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the seventh day of Splunk-mas my company gave to me
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the eighth day of Splunk-mas my company gave to me
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the ninth day of Splunk-mas my company gave to me
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the tenth day of Splunk-mas my company gave to me
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the eleventh day of Splunk-mas my company gave to me
Eleven virtual trainings,
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the twelfth day of Splunk-mas my company gave to me
Twelve Beefy Boxes,
Eleven virtual trainings,
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license!!!!

lguinn2
Legend

Awesome answer

0 Karma

jplumsdaine22
Influencer

The Splunk team should youtube this for next christmas

lguinn2
Legend

Here is a present for your developers: Logging best practices

Happy New Year!

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...