For those following this discussion, the long, awaited inclusion of .conf19 sessions is here! And for good measure, we've added .conf19 through .conf22. The app URL is https://splunkbase.splunk.com/app/3330. ... View more

The session catalogs varied between years. Some I was able to track down a JSON data file, others I had to manually screen scrape. But yes, if you wanted to modify or add your own links, just update that lookup file. ... View more

.conf18 sessions have finally been integrated along with some minor fixes. Enjoy! ... View more

For streaming (using AWS Kinesis Stream) from AWS GuardDuty to Splunk, check out this blog post: https://www.splunk.com/blog/2018/02/22/serving-it-up-with-aws-and-splunk-aws-serverless-application-repository-now-available.html To send GuardDuty CloudWatch events to Splunk over HTTP Event Collector, using the Splunk Logging AWS Lambda Blueprint, check out this video: https://www.youtube.com/watch?v=wlPfzUZMS6E ... View more

The .conf Archive Search app is here: https://splunkbase.splunk.com/app/3330/ ... View more

Version 3 has just been posted, which includes the .conf2017 sessions. ... View more

If you are using the Distributed Management Console (v6.2 to v6.4) / Monitoring Console (v6.5+) to monitor your Splunk deployment, there is a platform alert (i.e. saved search) that you can enable for “Expired and Soon To Expire Licenses” (with the desired alert action) which will fire when you have licenses that have expired or will expire within two weeks (default setting). About the Monitoring Console http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview Platform alerts overview http://docs.splunk.com/Documentation/Splunk/latest/DMC/Platformalerts Enable platform alerts http://docs.splunk.com/Documentation/Splunk/latest/DMC/Platformalerts#Enable_platform_alerts Which alerts are included? http://docs.splunk.com/Documentation/Splunk/latest/DMC/Platformalerts#Which_alerts_are_included.3F ... View more

When a dashboard is built on a scheduled search (as in your case), the dashboard will display the most recent search results rather than partial results from a running job. ... View more

Search head clustering (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/AboutSHC) was introduced in Splunk Enterprise 6.2, released on October 28, 2014. A search head cluster captain (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCarchitecture#Search_head_cluster_captain) coordinates activities among all cluster members. The responsibilities/activities include: Scheduling jobs Coordinating alerts and alert suppressions across the cluster Pushing the knowledge bundle to search peers Coordinating artifact replication Replicating configuration updates Also see: Migrate from a standalone search head to a search head cluster http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Migratefromstandalonesearchheads Use the deployer to distribute apps and configuration updates http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges How do you set app permissions in a search head cluster http://answers.splunk.com/answers/225426/how-do-you-set-app-permissions-in-a-search-head-cl.html ... View more