Zero Trust Architecture (ZTA) is becoming increasingly important in a cloud-first world where the perimeter no longer exists. As a result, identities, devices, virtual networks, applications, and data must be monitored and protected with an updated set of detections and controls that account for new access patterns and new types of attacks.     Tune in  to a technical demo and learn about:  Automating the daunting task of restricting, revoking, and restoring access Leveraging Risk-Based Alerting in the automation process Creating playbooks that implement Auto-Containment using various Inputs, Data Types and Actions   Speaker: Kelby Shelton, Senior Solutions Engineer, Splunk   ... View more

Back to March 2022 Newsletter     Face the Unexpected with the Stability and Resiliency of Splunk Cloud Platform Splunk Cloud Platform has an “always on," high availability commitment and is built to scale to your data analytics needs, ranging from GBs to PBs and beyond. Designed to facilitate sudden bursts in data volume, our platform allows you to incrementally upgrade capacity while retaining security by design.   Reminder: Splunk Cloud Platform will default to Python 3 soon In case you haven’t heard, Splunk Cloud Platform will be defaulting to Python 3 soon. To ensure you are prepared, review your personalized service bulletin email from last year titled “ACTION REQUIRED - Python 2 Removal from Splunk Cloud”, read our detailed documentation on migration, or use the in-product Upgrade Readiness App to ensure you are prepared. Please note that Splunk Cloud Platform did not default to Python 3 in 2021 as originally announced, and this change was delayed to 2022.   Your Go-To Workload Cheat Sheet Lantern is your repository of documentation, tutorials, training, and more to help you best navigate your experience using Splunk and get all of your questions answered. Our new Workload Pricing page gives you an introduction to Workload Pricing with SVCs (Splunk Virtual Compute), tips for efficient SVC utilization, and instruction on how to estimate your workloads. There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability highlights newsletters. Sign up now to receive the newsletter in your inbox. Sharing is caring! Feel free to share the newsletter with your colleagues. Until next month, Happy Splunking! Back to March 2022 Newsletter     ... View more

Back to March 2022 Newsletter   Observability Support Update Beginning March 16, 2022, the world-class Splunk Observability Support Portal is moving from SignalFx over to Splunk Salesforce.   What does this mean if I’m a NEW customer? Trial or POC users: Splunk Answers is the easiest route to get help. If trial customers need help with password resets, they can call Customer Service. Customers: Opening a new case: Customers may use the Splunk Support Portal or call Customer Service.  Accessing the Splunk Support Portal: From this link, or by clicking on Support and Community within the Observability Suite. * Chat: No change (accessed from within the product)   What does this mean for EXISTING customers? All open cases will be migrated to the Splunk Support Portal. New cases cannot be created by emailing. observability-support@splunk.com or signalfx-support@splunk.com. They will receive an automated response suggesting other routes to get support (Splunk Support Portal or Customer Service). Access the Splunk Support Portal: From this link, or by clicking on Support and Community within the Observability Suite. * Chat: No change (accessed from within the product)   *Don’t forget that your Observability login is NOT the same as your  Splunk Support Portal login. You will need to create a Splunk account (if you don’t already have one) to access your cases. The  “Working with Support” deck explains how to register and submit a support case.        Infrastructure Monitoring Splunk Observability Cloud now supports adding an optional message on charts when relevant active metrics are not found You can now add an optional message on graph charts, heatmap charts, list charts, and single value charts to indicate when metrics used in a chart either don’t exist or are inactive. More detailed documentation is available here.   Application Performance Monitoring Monitor & Alert through Custom Monitoring MetricSets in Splunk APM You can now create custom Monitoring MetricSets in Splunk APM with indexed span tags as custom dimensions to glean meaningful insights about your services in real time. Just like with default Monitoring MetricSets, you can also leverage custom Monitoring MetricSets to create custom charts, dashboards, and detectors to keep track of what matters most to your team. Learn more here.   There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability highlights newsletters. Sign up now to receive the newsletter in your inbox.  Sharing is caring! Feel free to share the newsletter with your colleagues. Until next month, Happy Splunking! Back to March 2022 Newsletter   ... View more

Back to March 2022 Newsletter   Accelerate Detection and Investigation with Security Analytics     Watch our on demand virtual event to learn about: The role Security Analytics plays today and in the future from special guest and Forrester Analyst, Allie Mellen Proactive risk based alerting for insider threats Splunk technology partnerships with Mandiant and Zscaler Intelligence Management for accelerated investigations in Splunk Enterprise Security The ramifications of the Log4j vulnerability and how businesses can prioritize critical security fixes There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability highlights newsletters. Sign up now to receive the newsletter in your inbox.  Sharing is caring! Feel free to share the newsletter with your colleagues. Happy Splunking!   Back to March 2022 Newsletter   ... View more

    Learn how Splunk Observability can help demystify challenges with monitoring distributed microservices   Watch Monitor and Alert on Your Kubernetes Clusters in Seconds  and learn how Splunk Observability can help demystify challenges with monitoring distributed microservices. You’ll also see a demonstration on how to correlate application and infrastructure behavior to streamline troubleshooting and alerting on-premises and in the cloud.   During this Tech Talk you'll learn how to: Deploy the Splunk OpenTelemetry Collector to gather Kubernetes Metrics Simplify your alert strategy for out-of-the-box alerting with AutoDetect alerting Resolve issues instantly in your Kubernetes workloads and cut down alert storms   Who will benefit:  Splunk Administrator, (IT, Security, Data, Business) Analyst, DevOps Engineers, Developers, SREs   ... View more

Back to Feb. 2022 Newsletter   February 2022  Highlights   Intelligence Management for Splunk SOAR   Looking to use intelligence from multiple sources to drive automation? Watch this Tech Talk to learn how Splunk Intelligence Management (formerly TruSTAR) integrates with Splunk SOAR to streamline playbooks and accelerate response through enrichment and priority scoring. Security Apps, Research/SURGe SURGe by Splunk brings technical guidance for responding to high-profile, time-sensitive cyberattacks. Empower your security team to stay ahead of emerging threats with SURGe Alerts. There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability newsletters.  Sign up now to receive the newsletter in your inbox.  Sharing is caring! Feel free to share the newsletter with your colleagues. Happy Splunking! Back to Feb. 2022 Newsletter ... View more

Back to Feb. 2022 Newsletter   February 2022 Highlights   Dashboard Studio Scheduled Email Export - Limited Availability Release Want to share your Splunk dashboard across your organization? Sign up for the Dashboard Studio Scheduled Email Export program! Available to limited customers, sign up to see if you are eligible or get on the waiting list.   Empowering Business Users with Pre-Structured Data   Do you have less technical users in your organization that could benefit from the data in Splunk? Watch this Tech Talk to learn how these users can leverage Splunk’s no-code features and you can get more out of your Splunk investment.   Splunk Cloud Platform Shared Responsibility Model Splunk Cloud Platform provides a complete suite of self-service capabilities to simplify actions customers can take to ensure the optimum customer experience. The Shared Responsibility Model Solution Guide illustrates the distribution of responsibility for the service.   Prevent Data Downtime with Anomaly Detection Discover how you can use Splunk’s Machine Learning Toolkit for monitoring ingest volume to reduce downtime. There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability newsletters.  Sign up now to receive the newsletter in your inbox.  Sharing is caring! Feel free to share the newsletter with your colleagues. Happy Splunking!   Back to Feb. 2022 Newsletter   ... View more

Back to Feb. 2022 Newsletter   February 2022 Highlights     RUM Enhanced Filters Filter your RUM views faster than ever before. Look for screens and URLs that you care about by adding a '*' to match against a simple keyword that is included in your RUM metrics. RUM has added support for case insensitive matching as well as starts-with (keyword*), ends-with (*keyword), and contains (*keyword*) matching of your high cardinality RUM metrics metadata.   Infrastructure Monitoring AutoDetect for simplified, out-of-the-box alerting Expand your infrastructure monitoring capabilities for both on-premises and in the cloud with AutoDetect for simplified, out-of-the-box alerting - a new feature in Splunk Infrastructure Monitoring available today at no additional charge. AutoDetect helps you get started in minutes to detect problems with your critical infrastructure components and services for quick time-to-value. Remove pain and complexity of having to manually setup your environment and automatically discover anomalies in your infrastructure within seconds. With intuitive alert integrations and workflows to Splunk Observability Cloud, enjoy an immediate, comprehensive understanding of your infrastructure state - all from a single, consolidated view for faster time to resolution. Sign up for a free trial of Splunk Infrastructure Monitoring and get a real-time view of your infrastructure across your IT environment on-premises and in the cloud.   APM Optimize slow or frequently executed queries with Database Query Performance in Splunk APM! Database Query Performance in APM helps you identify slow or frequently executed queries that affect service performance. You can also compare aggregate trends in query performance against historical time windows and correlate queries against application components, such as incoming service or endpoint. Existing Splunk APM customers can start using this immediately for free. Database Query Performance currently supports major SQL-based database types, without requiring any additional instrumentation. Learn more here. View available spans of a trace before trace completion with Ongoing Traces! Have you ever had a trace ID in your Jenkins job notification, logs or developer console, but couldn’t find the trace in APM? Previously, Splunk APM would only allow access to a trace once the transaction was completed (all spans for the trace were received and assembled). Ongoing traces enables you to search for and view a trace that’s still being assembled, using the Trace ID. You can view available spans and refresh the trace to load new spans that are received in real time, giving you immediate visibility into ongoing traces. Learn more here.   Synthetics Splunk Synthetics Enterprise Security Enhancements Splunk Synthetics recently released a series of updates designed to meet the sophisticated security needs of global enterprises.  These updates included launching support for SSO via SAML 2.0, adding the ability to conceal global variables used in synthetic tests, and upgrading the Splunk Synthetic Browser to Chrome version 97, which includes 38 known security patches.       Observability Suite Access Tokens Access Tokens in Splunk Observability platform can be used for Data ingestion, RUM or APIs. These tokens are currently valid for 5 years, however the industry standard is 1 year or less.  As a result, we are adjusting the lifetime of newly issued access token secrets downward to 1 year, from 5 years. This change is not retroactive, and existing access tokens continue to honor their potentially longer expiration dates. Organization admins will continue to get email alert notifications 30 days prior to their token expiration. Deprecation of support for SHA1 signed SSO Integrations In order to ensure secure authentication processes for all Splunk Observability Cloud customers we have already deprecated support for new SSO certificates signed using the SHA1 hashing algorithm. Configuring new integrations using SHA1 is already disabled. On 2 April, 2022 we will be disabling the use of this algorithm for authentication. Customers with existing SHA1-signed certificates will need to generate new certificates via their SSO provider and rotate these credentials in the SSO configuration. Splunk Support can assist customers if necessary with this rotation.   ITOps Splunk Ideas: Turn your idea into a new feature Have you ever thought about an idea and wished that you could share it directly with fellow Splunk experts and builders? Now you can. In the Splunk Ideas portal, you can search for, vote on, and request new enhancements (called an idea) for any of the Splunk solutions. There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability newsletters.  Sign up now to receive the newsletter in your inbox.  Sharing is caring! Feel free to share the newsletter with your colleagues. Happy Splunking!   Back to Feb. 2022 Newsletter ... View more

Platform | Security | Observability     Inside the February 2022 Newsletter Platform Highlights.  View Security Highlights.  View   Observability Highlights.  View    .conf22  June 13-16, 2022 | Las Vegas, NV, and online  Call for Speakers Submission Deadline: Monday, February 28 at 11:59 pm PST.  Learn more and prepare your .conf submission.   Call for Speakers Workshop Webinar Want to get your submission in tip-top shape? Join us on Thursday, February 17 at 9 am PST to hear tips and tricks from past .conf speakers and ask questions during the Q&A.  Register for webinar   Education Corner   Certification Update: Splunk Certification is all about bragging rights and is excited to launch the newest digital badges in our Learning Collection: Troubleshooting Splunk Enterprise, Architecting & Deploying Splunk Enterprise, Splunk Enterprise Cluster Administration, and the Splunk Enterprise Deployment Practical Lab. Complete the courses (or receive a badge for previous accomplishments!), collect your badges, and share with your network. Remember, you can add as many email addresses (and update your default!) to your Credly account as you need. Please visit Credly Support and verify your account is up-to-date. Any questions regarding this can be directed to certification@splunk.com.   Authorized Learning Partner (ALP) Update: We’re happy to announce two new ALP partners, Fast Lane Central Eastern Europe and Trainocate. They have been selected as Authorized Learning Partner to deliver Splunk training across most of Europe and APAC. ALPs market, sell and deliver Splunk authorized training using their own resources, or sell into Splunk’s class schedules, all of which are needed to rapidly meet the increasing demand for Splunk training, globally.  ALPs bring a value-add of localization, language and cultural skills to bring Splunk education to more markets than ever before. Whether you are looking for multi- or single-topic training courses, in-person or virtual training, ALPs will deliver. Click here for more information or contact partner+@splunk.com for more details. Looking for Splunk Training + Certification resources? All things Splunk Certification >> Splunk Certification Handbook And ICYMI: The newest comprehensive resource >> Splunk Education Student Handbook     SplunkBase Apps   More updates in the Splunkbase Preview: You can view not only the app catalog, collections, and categories but now also the app listings, too! Take a look and share your thoughts with us by clicking the Feedback button on the upper right corner of the page. New Apps and Recent Updates: Ready for the updates to latest Python and jQuery releases? Splunk admins and developers can grab the latest Upgrade Readiness App v3.1 (here for original Splunkbase) to scan their public and private apps for readiness. Splunk Cloud Platform users will get this update automatically with the latest update. Are you a GitHub admin? There are some bug fixes and dashboard improvements in the community supported GitHub App for Splunk v1.1.2 (here for original Splunkbase) including the Code Scanning and Secret Scanning dashboards.  How do you know when a data source has stopped sending data to Splunk? Try the Broken Hosts App for Splunk v4.1.2 (here for original Splunkbase)   There is always a lot to talk about at Splunk! Every month we share timely news and announcements through our Platform, Security and Observability newsletters.  Sign up now to receive the newsletter in your inbox.  Sharing is caring! Feel free to share the newsletter with your colleagues. Until next month, Happy Splunking!       ... View more

IT Edition | Monitoring Risk Management Framework Compliance with ITSI Watch Now     In this IT Tech Talk, Splunk’s Travis Hall will show you how to quickly set up Risk Management Framework (RMF) monitoring and reporting in Splunk. Travis will also discuss how this process can be replicated for other compliance services and share some additional resources and documentation for you to leverage while getting started ... View more

Tech Talk: DevOps Edition How to Create Custom Dashboards and Alerts to Achieve the Best Mean Time to Detection Alerts and dashboards are essential to observability. They allow you to catch problems anywhere in your environment so you can rapidly identify their causes and minimize service degradation and disruption. Splunk Observability Cloud uses detectors, events, alerts, and notifications to keep you informed when certain criteria are met. Watch Now  In this Splunk Tech Talk, DevOps Edition, we will cover just how to create custom dashboards and alerts to achieve the best Mean Time to Detection for possible issues and mitigate service degradation. Tune in to learn:  How you can create and customize new and existing dashboards Share dashboards with teammates Set dashboard permissions with teammates How to configure alerts based on your data for the best Mean Time to Detection (MTTD) ... View more

Tech Talk: Security Edition Detecting Lateral Movement with Splunk Watch Now  In this tech talk, we will cover the most common Lateral Movement techniques affecting Microsoft environments and how to detect this behavior using Splunk.   Tune in  to this webinar to learn about:  The most common ways adversaries move laterally in Windows environments The detection opportunities defenders have to detect these techniques ... View more

Tech Talk: DevOps Edition Instrumenting Your Microservices Based JavaScript Application From Start to End Watch Now  In this Splunk Tech Talk, DevOps Edition, we will use a basic NodeJS microservices based application deployment to learn how to instrument Javascript using the Splunk Distribution of OpenTelemetry JS. We will take a deep dive into the basic code changes and steps required to begin collecting telemetry and understand our customer’s experience.   Tune in  to learn how to: Instrument your NodeJS application programmatically with the Splunk Distribution of OpenTelemetry for JavaScript within a microservices based deployment Deploy the Splunk Distribution of the OpenTelemetry Collector to capture critical infrastructure and application telemetry Configure browser instrumentation with Splunk Real User Monitoring and gain insight into the performance and health of the front-end user experience to best understand your customer’s experience ... View more

Tech Talk: Security Edition What’s New with Enterprise Security 7.0? Explore what is in the newest release of Splunk Enterprise Security and hear from Enterprise Security Product Management leadership about what’s next.   Watch Now  Tune in to learn about: A quick recap in the updates to version 6.6 All the new features in 7.0 as well as a demo of the awesome new user experience How to learn more about Splunk Enterprise Security ... View more

    Crawl, Walk, Run: Getting Started with AIOps Replay the Tech Talk   and we'll walk through what it takes to build a world-class IT Operations Management infrastructure with Splunk. From simple alerting to sophisticated event management, deep service insights, predictive analytics, and on-call management. ... View more