What is Santa bringing your Splunk instance?

[jplumsdaine22]

We asked Santa to teach users to use the same timestamp format in every log file

[acharlieh · Accepted solution]

Albeit fictitious and and possibly a little off due to the late hour, this seemed like the most appropriate answer:

On the first day of Splunk-mas my company gave to me
A money cannon for my next license.

On the second day of Splunk-mas my company gave to me
Two quick ref Cards,
And A money cannon for my next license.

On the third day of Splunk-mas my company gave to me
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the fourth day of Splunk-mas my company gave to me
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the fifth day of Splunk-mas my company gave to me
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the sixth day of Splunk-mas my company gave to me
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the seventh day of Splunk-mas my company gave to me
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the eighth day of Splunk-mas my company gave to me
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the ninth day of Splunk-mas my company gave to me
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the tenth day of Splunk-mas my company gave to me
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the eleventh day of Splunk-mas my company gave to me
Eleven virtual trainings,
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license.

On the twelfth day of Splunk-mas my company gave to me
Twelve Beefy Boxes,
Eleven virtual trainings,
Ten teams onboarding,
Nine sourcetypes parsing,
Eight Proserve Hours,
Seven Apps Installing,
Six Certs Encrypting,
Five Black Tshirts,
Four .conf passes,
Three New Databases,
Two quick ref Cards,
And A money cannon for my next license!!!!

[lguinn2]

Awesome answer

[jplumsdaine22]

The Splunk team should youtube this for next christmas

[lguinn2]

Here is a present for your developers: Logging best practices

Happy New Year!