What should I do at my first Splunk .conf conference?

[Task1906]

After attending a pair of confs I wanted to start a thread of thoughts about What should I do at my first Splunk .conf?

I have a single question at the bottom. Feel free to add on and make suggestions.

• Visit official Splunk booths
  Outside of your scheduled sessions this should be your top priority when you get there. This is when you get to speak with the development teams behind current, new and upcoming Splunk modules and features. There are some neat non-NDA internal projects also worth seeing especially if you have a homelab and want to do some cool weekend projects.
  My Experience: Last year my most memorable conversation was with the MLTK team when i asked them why UBA didn't leverage MLTK if MLTK was as awesome as the streets tell me. This year I spoke with the someone from the UI team and we spoke about the color palette challenges they were faced with the dark mode.

• Visit Vendor booths
  Many of them are MSPs or Splunk app makers. Because MSPs are trying to sell you a service they are more willing to share real world processes and challenges that you can take back to your shop. You can also speak with app & appliance vendors about their TA. Your shop use syslog-ng? They are there. Your shop use Checkpoint? They are there. ect.

• Visit 'Ask The Experts' (get answers, you can)
  This is your opportunity to sit with a Splunk expert and have them answer your questions. I've seen people break out laptops, but I always have my questions ready to go by the time I get there. Splunk Answers is where I ask 'How' questions. 'Ask the Experts' is the perfect opportunity to ask 'Why' questions in a face to face Apple store Genius Barish setting.

• Visit the 'Innovation Lab' (the only place you can't take photos)
  Here is where you really get to see some AMAZING things Splunk is doing internally. They make you sign an NDA before you can enter and because of that I can't get any much more specific. What I can say is that I was beyond impressed by what I saw in there.

• Sign up for BOTS or BOTN (gather three co-workers and find a cool team name)
  These competitions take place just before .conf and will do two very important things for you:

  1 Expose you to Splunk use cases with accompanying data sets. This data is VERY robust. The use cases go from really really easy, all the way up to REALLY hard.

  2 Give you a FREE hands-on with Splunk's entire Enterprise offering (as of the time of this writing it is UBA,MLTK,ES & Phantom) all configured and all ready to get busy on the data set they provide for you.

  3 There is a Splunk session dedicated to analyzing the data generated from the competition. The description made it sound really interesting and I didn't realize this until it was too late, my 3rd biggest miss of .conf.

The innovation lab had some things in there that I want my company to have a hand in testing. But because I didn't read the details of the NDA, and I am uncertain if I can even ask my sales person about the project I have in mind. How can I get in contact with a specific team from the innovation lab?

[nwoodco1]

While I normally agree with almost everything that @woodcock says, I must disagree a bit here. I know of at least 1 session at .conf2018 where the audience was told that recording and slides would be published but when everything was posted, that session was not published at the presenter's request. So if the content is critically important to you, you should go and make your own audio recording and take pictures or you might not ever see it again.

Also, be sure to monitor the #conf2020 slack channel and announcements inside the app or you will miss out on important details like Free drones while supplies last at the Community Lounge which lasted for about 3 minutes (no I did not get one) and also The "NOCturnal" TShirts are in booth XYZ near the FuBar in X Hall (I did get this).

[woodcock · Accepted solution]

This is a bit late but here is my advice:

-1: Be sure to ask your sales team for free passes to .conf (hit or miss here).
0: Be sure to submit a talk early when the Call For Papers is announced to share with others the cool things that you are doing with Splunk. If you get selected, you get a free pass and bragging rights!
1: Be sure to sign up for BOTS/BOTN as early as possible (seats are limited and fill up in a day or 2).
2: Be sure to consider coming early for a Splunk University Bootcamp; this is the easy button to get certified.
3: Be sure to sign up for a PearsonVue Certification Test at a 70% discount (only $50) and get a free pair of Splunk-branded earplugs.
4: Be sure to stop by the First Time Run (AKA FTR) booth if this is your first (or even second) conference; they will have good advice for you on new Do not miss things.
5: Be sure to visit the Innovation Labs. This will be your ONLY CHANCE EVER to see what is planned not for this year/release, but for the one after that. You can often sign up to be an alpha/beta user here and drive the evolution of features/projects that are important to you.
6: Be sure to participate in Birds of a Feather events. This is your best opportunity to meet other Splunk engineers who operate in your space/vertical. Meet them and exchange business cards and help one-another.
7: Be sure to download and use the app. This year (and probably future years), the seats in the sessions require registration through the app. If you do not register, you do not get in.
8: Be sure to consider the BSides technical talks. This year they were not listed in the app and may not be listed next year, either. You can see the schedule here: https://www.SplunkCommunity.com.
9: Be sure to participate in the Splunk4Good volunteer event (packing meals for the needy, etc.)
10: Be sure to come by the Ask the Experts booth. Where else can you get TOTALLY FREE expert advice which would normally cost you $300+/hour?
11: Do not get too hung up on attending the sessions; these are all recorded (except for a few of the keynotes) so you can watch them later. It is more important to meet people and mingle.
12: Even if you are tired, don't skip the Search Party (but do bring those earplugs). It is always fun, with plenty of food, and a great place to meet people.
13: Don't gamble. it is a tax for people who are bad at math.

[jcaceres]

Talk to the people presenting at the innovation lab about participation and feedback opportunities.
They will also have contact info re: their project.

[burwell]

Hi. I would start by asking your sales person for contact for things shown in the Innovation Labs.