Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or troubleshooting complex network-to-application performance issues, our May sessions are designed to provide the clarity you need. Join our upcoming webinars, Tech Talks, and Office Hours to connect with product experts and master your Splunk deployment. Key Takeaways Master Enterprise Security: Compare Essentials vs. Premier editions and plan your migration with our EMEA expert team. Unify Observability: Learn how to integrate Splunk Observability Cloud and Cisco ThousandEyes for end-to-end visibility. Expert Access: Join live Q&A and deep-dive sessions to solve your most critical technical challenges in real-time. Observability & Network Performance Gain a complete view across your stack so you can quickly determine whether issues originate from your application, infrastructure, or network. [LEARN] Webinar: A Unified View (Splunk Observability & Cisco ThousandEyes) Date/Time: May 19, 2026 | 10:00am – 11:00am PT Register Here Focus: Learn how to combine these powerful tools to focus on the telemetry that actually matters for your business outcomes. [GROW] Tech Talk: Observability Simplified Date/Time: May 28, 2026 | 10:00am – 11:00am PT Register Here Focus: A deep dive into surfacing insights across the stack by bringing user experience, application performance, and network behavior into a single, usable view. Community Office Hours: Security Focus Community Office Hours is an interactive series where technical Splunk experts provide how-to guidance on various product topics. While this session is scheduled for EMEA time zones, it is open to everyone. [PLAN] Enterprise Security Essentials & Premier AMA Date/Time: Wednesday, May 20, 2026 | 10:00am BST / 11:00am CEST Register Here What you can ask: Functional differences between ES Essentials and Premier. Migration strategies for existing dashboards and investigations. Integration best practices for SOAR and UEBA. Education and professional service paths for expert practice. Ready to sharpen your skills? Register for these sessions today and bring your toughest questions to the table!   Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

How Splunk Real User Monitoring Helps You Find and Fix Front-End Issues Faster Your front-end is where customer experience lives or dies and traditional monitoring tools aren't built for today's complexity. Between device fragmentation, third-party dependencies, flaky CDNs, and back-end bottlenecks, pinpointing why a user had a poor experience can feel like searching for a needle in a haystack. Splunk Real User Monitoring changes that equation by giving you real-time visibility into what your actual users are experiencing, so you can stop guessing and start fixing.   🔑 Key Takeaways Real sessions, not synthetic guesses: Splunk Real User Monitoring captures genuine user interactions, including Core Web Vitals, JS errors, and session replays—powered by OpenTelemetry for full flexibility. Pinpoint issues in seconds: Features like Tagged Spotlight and one-click root cause analysis let you isolate problems by browser, device, location, or back-end dependency fast. End-to-end visibility out of the box: Native integrations with Splunk APM and ThousandEyes connect front-end symptoms to back-end and network root causes without manual correlation. Why Real User Monitoring Matters Now The complexity of modern front-end environments (device types, browser configurations, network conditions, third-party APIs, and back-end systems) has outpaced what traditional synthetic monitoring can reliably catch. Issues that affect a subset of users (say, Safari on iOS over a specific ISP) often go undetected until customers complain. Splunk Real User Monitoring addresses this head-on by continuously tracking real user sessions across your web and mobile applications. It monitors key performance indicators including: Core Web Vitals — page load speed (LCP), interactivity (FID), and visual stability (CLS) JavaScript errors and resource loading failures User session context — browser, OS, device, geography Because data collection is built on OpenTelemetry, you get vendor-neutral instrumentation with the flexibility to customize what you capture—right out of the box. Feature Deep Dive: What Makes Splunk Real User Monitoring Stand Out How to Isolate Problems Faster with Tagged Spotlight Not all performance issues look the same. A checkout page that loads fine on Chrome/Windows might crawl on Safari/iPhone. Tagged Spotlight lets you slice performance data by key dimensions—browser, OS, device type, or geographic region—so you can instantly spot which user segments are affected. Why it matters: Instead of sifting through mountains of undifferentiated telemetry, you get actionable, context-aware insights that point you toward the exact conditions causing friction. How to Recreate User Journeys with Session Replay When a user reports "it's broken," you need more than a vague description. Session Replay lets your team recreate user interactions as video playbacks or wireframes, paired with rich metadata: Click paths and navigation sequences Page load timings per interaction Error details tied to specific moments in the session This bridges the gap between subjective frustration and objective, data-backed remediation steps—giving you the confidence to act quickly. How to Trace Root Causes Across the Full Stack Front-end symptoms often have back-end causes. Splunk Real User Monitoring in Splunk Observability Cloud integrates seamlessly across the platform, enabling you to pivot from a user session directly to back-end APM traces with a single click. Whether the culprit is a slow API call, a misconfigured database query, or a failing microservice, this end-to-end traceability eliminates the guesswork and finger-pointing between front-end and back-end teams. How to Rule Out Network Issues with ThousandEyes Correlation Network problems are a frequent—and frustrating—source of poor user experience. Splunk Real User Monitoring includes out-of-the-box correlation with ThousandEyes, so you can instantly determine whether a degradation is application-related or network-based. By combining ThousandEyes' network path intelligence with Splunk's application telemetry, you get complete visibility across the entire digital delivery chain—from user browser to origin server and every hop in between. Best Practices for Getting the Most from Splunk Real User Monitoring To maximize your return from Splunk Real User Monitoring, keep these practices front and center: Prioritize Core Web Vitals — Focus on LCP, FID, and CLS as your baseline health indicators. These are the metrics Google uses for search ranking and the metrics your users feel most acutely. Use Session Replay on high-impact journeys — Don't try to replay everything. Target login flows, checkout processes, and onboarding sequences—the moments where friction costs you the most. Always correlate with back-end traces — Front-end visibility alone only tells half the story. Use Splunk Observability Cloud to connect browser-side symptoms to server-side root causes across your full stack. Tag deliberately for segmentation — Create meaningful tags for device type, browser version, geography, and customer tier so you can quickly filter and compare performance across user segments.   Start Monitoring Real User Experiences Today Users expect fast, seamless digital experiences—and they don't wait around when they don't get them. Splunk Real User Monitoring gives you the real-time, full-context visibility you need to catch issues early, resolve them faster, and keep your customers coming back. 👉 Start a free trial or take a guided tour on Splunk.com — and make sure your front-end delivers the experience your customers (and your business) deserve.   Never miss a new post. Check out this short guide on how to subscribe to the blog and get updates.  ... View more

Are you looking to streamline your data pipelines or sharpen your security and observability strategies? Join our live April sessions to get direct guidance from Splunk experts on your most pressing technical challenges. TL;DR / Key Takeaways Live Troubleshooting: Join interactive Office Hours to resolve database monitoring and security AI challenges. Expert Insights: Learn how to leverage Cisco Data Fabric for AI-powered data management and automated pipelines. Direct Access: Connect with product experts, ask your questions, and gain actionable best practices in real-time. Community Office Hours: Interactive Q&A Community Office Hours is an interactive series where technical Splunk experts answer your questions and provide how-to guidance. Pre-submitted questions are prioritized, so please submit yours during registration or via the #office-hours Slack channel. [LEARN] Database Monitoring in Observability Cloud Date/Time: April 16, 2026 | 11:00am / 2:00pm ET [Register Here] Key Topics: Proactively identifying and resolving slow queries. Connecting database performance with application and infrastructure telemetry. Troubleshooting query performance and root cause analysis. Configuring Observability Cloud for database telemetry collection. [SECURE] Splunk AI in Security AMA Date/Time: April 22, 2026 | 11:00am PT / 2:00pm ET [Register Here] Key Topics: Best practices for leveraging the AI Toolkit and AI Assistant in Security. Streamlining investigations and accelerating threat detection. Integrating AI capabilities with existing security workflows. Licensing and training resources for AI-powered security adoption. Tech Talks: Deep Dives Tech Talks provide an exclusive look at new architectures and product capabilities designed to help you scale and optimize your environment. [BUILD] AI-Powered Data Management Date/Time: April 23, 2026 | 11:00am PT / 2:00pm ET [Register Here] Focus: Explore the Cisco Data Fabric architecture and new AI-powered capabilities designed to turn raw telemetry into real-time intelligence. What you will learn: How to move beyond manual toil with automated field extraction and auto-schematization. Techniques for building self-healing pipelines. Strategies to ensure data is always analytics-ready, reducing operational overhead. Ready to level up? Register for these sessions today and bring your toughest questions to the table! ... View more

Master Your Splunk Deployment: March 2026 Expert Sessions Are you looking to optimize your Splunk environment or get direct answers to your toughest technical questions? Join our upcoming March sessions to connect with product experts, troubleshoot real-world challenges, and accelerate your success. Key Takeaways Get Live Answers: Join interactive Office Hours for real-time troubleshooting and personalized guidance. Deep Dive Learning: Attend Tech Talks for best practices, new feature exploration, and product insights. Expert Access: Engage directly with Splunk specialists across Security, Observability, and Platform domains. March 2026 Event Schedule [SECURITY] Office Hours: Enterprise Security Topic: Enterprise Security Essentials and Enterprise Security Premier Date: March 18, 2026, at 11am PT What you can ask: How does ES Premier differ from ES Essentials? What are the migration considerations from Essentials to Premier? How do SOAR and UEBA integrate with the ES ecosystem? Bring your own questions—anything is on the table! [OBSERVABILITY] Office Hours AI-Powered Observability and Observability for AI Date: March 19, 2026 Focus: Get personalized guidance on monitoring the health, performance, security, and cost of your AI application stack. Splunk Application Performance & Infrastructure Monitoring Date: March 26, 2026, at 11am PT Focus: Interactive session driven by your real-world challenges, from call graphs to Kubernetes alerts. [PLATFORM] Tech Talks SPL2 Deep Dive Date: March 12, 2026, at 11am PT Focus: Unifying data preparation, search, and transformations across the Splunk ecosystem. Native AI Intelligence: Hosted GenAI Foundation Models Date: March 19, 2026, at 11am PT Focus: A deep dive into piping data natively into specialized LLMs for SOC, SRE, and Network Analysts. Data to Value: Cost and Cloud Optimization Date: March 26, 2026, at 11am PT Focus: Taking control of data management and cloud migration journeys. [APP DEV] Tech Talk Collaboration Experience as an Early Warning of Hidden Network Issues Date: March 23, 2026, at 11am PT Focus: Correlating collaboration telemetry (Teams) with network and infrastructure data to identify issues proactively.   Ready to level up your skills? Register for these sessions today and bring your toughest questions to the table! Understanding Our Expert Series What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts. Whether you are just starting your journey or looking for best practices to take your deployment to the next level, this is a safe, open environment to get the help you need. What are Tech Talks? Tech Talks are designed to accelerate your adoption and ensure success. In these 60-minute sessions, we dive deep into best practices, share valuable insights, and explore new use cases to expand your proficiency with our products. Never miss a new post. Check out this short guide on how to subscribe to the blog and get updates.    ... View more

February Event Highlights: Security Focus: Join the "Insider Threats" AMA to learn about indicators of compromise, risk scoring, and UEBA best practices. Platform Focus: A deep dive into SPL2, featuring the new Module Editor, SQL-like syntax, and the SPL-to-SPL2 converter. Format: All sessions are 60-minute interactive Zoom calls with live Q&A from Splunk technical experts. Dates: Security AMA (Feb 18) | Platform SPL2 AMA (Feb 19).   Upcoming February Community Events Security AMA: Detecting and Investigating Insider Threats Date: February 18, 2026 | 11am PT Registration What can I ask in this session? What are the most common insider threats today, and what are the typical indicators associated with them? What are the key considerations when detecting and analyzing insider threats? What are the best practices for detecting and investigating insider threats using Splunk? How can I maximize the use of threat intelligence and contextual insights when investigating insider threats? How can I best leverage data from Splunk to understand insider threat trends? How can machine learning and AI be used to scale your analytics? Can you provide insights on how User and Entity Behavior Analytics (UEBA) helps detect insider threats? How does the risk scoring work?   Platform AMA: Comprehensive Guide to SPL2 Date: February 19, 2026 | 11am PT Registration What can I ask in this session? Can you provide examples of how the SQL-like syntax in SPL2 can be used for common data analysis tasks? What is the module editor and how does it help me do my job? What are the expected performance improvements when using SPL2 compared to traditional SPL for large datasets or complex queries? How does the "point-and-click SPL to SPL2 converter" work, and what are its limitations?   About Community Programs What are Community Office Hours? Community Office Hours are an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you! What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.   Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you! What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.   SECURITY Office Hours | Security: Splunk Threat Research Team - Security Content AMA January 21, 2026 at 11am PT What can I ask in this AMA? What are the latest security content updates from the Splunk Threat Research Team? What are the best practices for implementing the Splunk Technology Add-on for Ollama? What tips and tricks can help leverage Splunk Attack Range, Contentctl, and other resources developed by the Splunk Threat Research Team? What new analytic stories and detections can surface AI-enabled workflows to help you detect and respond to emerging threats across critical enterprise platforms? How do the detections work across the integration between Cisco Talos and Splunk? Any specific questions you have when you leverage the out-of-box-detections?  Any other questions about the team’s content and resources!   OBSERVABILITY Office Hours | Application Performance Monitoring (APM): Ask Me Anything January 20, 2026 at 1pm PT What can I ask in this AMA? How can I best use Call Graphs? How do I use Service Grouping? Where can I find APM utilization dashboards? Anything else you'd like to learn!   PLATFORM Office Hours | Platform AI: Ask Me Anything January 22, 2026 at 11am PT What can I ask in this AMA? What new AI tools and capabilities are available today? How can I get started with MCP server? What are some common use cases to get started with the AI Toolkit or DSDL app? How can Splunk help me monitor and secure my generative AI applications? Can I develop and package a custom machine learning model in Splunk? Anything else you’d like to learn! Tech Talk | Splunk MCP & Agentic AI: Machine Data Without Limits January 29, 2026 at 11am PT In this session, we’ll show how MCP empowers autonomous AI agents to retrieve, process, and share live data anywhere it’s needed — breaking barriers and accelerating insight across your organization. You'll leave this talk with the following: A clear understanding of Agentic AI and where Splunk MCP fits in the ecosystem. An overview of Splunk’s MCP Server, including installation and configuration essentials. Example use cases showing MCP in action with agentic AI systems.   APP DEV Tech Talk | Application Management with Targeted Application Install for Victoria Experience January 26, 2026 at 11am PT Apps create endless opportunities to leverage the strengths of the Splunk Cloud platform. Until now, you could only install Splunk apps across every search head on a Splunk Cloud Platform Victoria Experience deployment. With TAI you now have fine-grained control over which search head groups will run which apps. This improvement is one of the top 10 voted ideas on Splunk Ideas. It allows customers to better isolate use cases and workloads to specific groups of users of their Splunk Cloud Platform Victoria Experience deployments. It also reaches parity with app installation functionality between Splunk Enterprise and Splunk Cloud Platform Classic Experiences. ... View more

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But how do you truly know if your applications are consistently delivering that flawless experience? How do you move beyond guesswork to genuine understanding?  In comes Splunk Digital Experience Monitoring (DEM), your answer to unlocking superior user experiences. For those unfamiliar or needing a quick refresh, Splunk DEM isn't just another monitoring tool, it's a comprehensive approach designed to give you unparalleled visibility into every digital interaction. Think of it as your eyes 👀 and ears across the entire user journey, helping you understand, optimize, and secure your applications from the user's perspective.  Why Digital Experience Monitoring Matters More Than Ever  Consider the stakes: a slow loading page, a broken checkout flow, or an unresponsive mobile app can instantly turn a potential customer into a lost opportunity. In this environment, simply knowing your servers are "up" isn't enough. You need to understand the quality of the experience your users are having. Splunk DEM helps you navigate these complexities by enabling you to:  Proactively Discover Hidden Problems: Instead of waiting for customer complaints, DEM helps you uncover performance bottlenecks and potential issues before they impact your users. It's about shifting from reactive firefighting to proactive problem-solving.  Rapidly Pinpoint Root Causes: When an issue does arise, DEM provides the contextual clues 🔎 needed to quickly trace the problem. No matter whether it originates in the user's browser, a third-party service, or deep within your backend infrastructure.  Quantify User Impact: Understand the true business cost of performance degradation. DEM helps you connect technical metrics to real-world user frustration and abandonment rates.  Drive Continuous Improvement: With clear insights into user behavior and application performance, you gain the knowledge to iteratively enhance your digital services, ensuring a consistently excellent experience.  Real-World Impact: Rappi’s Success Story When Latin American delivery leader Rappi experienced a 300% surge in on-demand orders, maintaining flawless digital experiences became mission-critical. Using Splunk Digital Experience Monitoring, Rappi’s team identified and resolved issues 90% faster, keeping their users happy during record growth.  “We’re all attuned to the potential business impact of app errors or poor performance, so we’re grateful that Splunk Observability Cloud helps us be proactive about reliability and resilience with end-to-end, real-time visibility into our environment.”  — Rappi Engineering Team  The Power Duo: Real User Monitoring (RUM) and Synthetic Monitoring  Splunk DEM achieves comprehensive insights through two primary components: Real User Monitoring (RUM) and Synthetic Monitoring.   Real User Monitoring (RUM): Seeing Through Your Users' Eyes  Imagine being able to literally see and analyze every single interaction a real user has with your application, from the moment they land on a page to their final action. That's the essence of Splunk Real User Monitoring (RUM), it helps you understand, measure, and improve your end-user experience.  RUM offers an unparalleled, end-to-end, NoSample™ view of your users' experiences. This means it collects data from every single user session, providing a complete and accurate picture, not just a statistical sample. It's like having a detailed report for every visitor, showing:  Page Load Performance: How quickly pages render, identifying slow-loading assets or scripts.  JavaScript Errors: Catching client-side errors that might disrupt user flows.  User Latency: Understanding delays users experience, from network to server response.  Session Replay: For critical issues, you can even visually "replay" a user's session to understand their exact journey and the point of failure, offering invaluable context for troubleshooting.  Core Web Vitals Integration: Splunk RUM helps you track and improve Google's Core Web Vitals (Largest Contentful Paint, First Input Delay, Cumulative Layout Shift), which are crucial for search engine ranking and overall user satisfaction.  Mobile Insights: Extending beyond web, RUM provides granular data on mobile app performance, including crashes, network requests, and lifecycle events across iOS, Android, and hybrid apps.  By meticulously tracking these metrics, Splunk RUM empowers you to understand what your users are experiencing, where they encounter friction, and how those issues impact their journey.  Synthetic Monitoring: Proactive Health Checks for Predictable Performance  While RUM tells you what is happening, Synthetic Monitoring helps you understand what could happen, allowing you to get ahead of problems. It acts as your always-on, vigilant sentinel, proactively simulating user interactions with your applications, websites, and APIs from nearly 50 global locations.  Here's how Synthetic Monitoring provides proactive understanding:  Baseline Performance: Establish a consistent baseline for application availability and response times, ensuring your services meet expected performance levels 24/7.  Critical User Journey Validation: Script and continuously test essential user flows like logging in, adding items to a cart, or completing a purchase to ensure they function correctly and perform optimally, even during off-peak hours. This is done through various tests including Browser, Uptime, and API tests.  Pre-Production Testing: Integrate synthetic tests into your CI/CD pipeline to catch performance regressions before new code deployments ever reach your live users. This helps you understand the impact of changes in a controlled environment.  Third-Party Dependency Monitoring: Understand how external services (payment gateways, content delivery networks) impact your application's performance and availability.  Competitive Benchmarking: Gain insights into how your application performs against industry peers, helping you understand your competitive standing.  Synthetic Monitoring provides the confidence that your critical services are always available and performing as expected, allowing you to identify and resolve issues before they ever become a real user problem.  A Unified View with Splunk Observability Cloud  The true power of Splunk Digital Experience Monitoring is realized when it's integrated within broader Splunk Observability Cloud. This unified platform brings together all your metrics, traces, and logs, creating a seamless, end-to-end view of your entire application stack.  This integration means that when RUM or Synthetic Monitoring flags an issue, you're not left guessing. You can instantly pivot to your APM (Application Performance Monitoring) tools to delve into backend services, infrastructure, and code to rapidly identify the root cause. This holistic approach transforms raw data into actionable insights, guiding you from problem detection to resolution in minutes.  Ready for a Deeper Dive? Join Our Community Office Hours!  Understanding and optimizing your digital experience is a continuous journey. Whether you're looking to refine your RUM strategies, master Synthetic Monitoring, or simply explore the full potential of Splunk DEM, our experts and community are here to help.  Join us for our upcoming Community Office Hours session December 9th at 11am PT on Synthetic and Real User Monitoring! This is a great opportunity to ask questions, share insights, and learn best practices directly from Splunk Product Managers and fellow users.    Register now and secure your spot!  Keep the good stuff coming. Here’s how to subscribe to this blog — and stay in the loop on the topics that matter to you.   ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you! What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.  SECURITY Office Hours | Splunk SOAR December 10, 2025 at 11am PT What can I ask in this AMA? What's new in the latest Splunk SOAR? Should I upgrade to this version, and what's the easiest way to make the upgrade happen? How does the Splunk Attack Analyzer integration work? And how can playbooks be implemented to automate response processes for the malware and phishing attack? What are the practical ways to modernize legacy SOC workflows with Splunk Enterprise Security and build the TDIR workflow. How to use Wayfinder? How to measure the value of my SOAR investment? Real-world examples of how SOAR enhancements improved efficiency, security, and ROI? Anything else you'd like to learn!   OBSERVABILITY Office Hours | Synthetic and Real User Monitoring  (RUM) December 9, 2025 at 11am PT What can I ask in this AMA? How do I get a more complete view of the user experience on my app or website? How do I correlate front and backend investigations? Can you give me tips on proactively finding and fixing performance issues? How can I gain insights into user engagement and behavior? Anything else you'd like to learn!   PLATFORM Office Hours | EMEA Community Office Hours: Splunk 10.0 Upgrade December 2, 2025 at 7am PT What can I ask in this AMA? How do I get a more complete view of the user experience on my app or website? How do I correlate front and backend investigations? Can you give me tips on proactively finding and fixing performance issues? How can I gain insights into user engagement and behavior? Anything else you'd like to learn! Office Hours | APJC Community Office Hours: Splunk 10.0 Upgrade December 4, 2025 at 4pm PT What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn! Tech Talk | Enter the Agentic Era with Splunk AI Assistant for SPL 1.4 December 9, 2025 at 11am PT Join this Tech Talk to learn more about: How AI Assistant for SPL shows agentic reasoning steps and corresponding tool-calling based on that reasoning for better response quality and explainability How you can optimize and speed up your SPL searches with the new Optimize SPL capabilities The latest info on additional LLMs that can be leveraged with this update Office Hours | AMER Community Office Hours: Splunk 10.0 Upgrade December 11, 2025 at 1pm PT What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn!   APPDYNAMICS Webinar | Effective Security Troubleshooting with AppDynamics and Cisco Secure Applications December 11, 2025 at 12pm PT Learn practical strategies for troubleshooting security issues using CSA and AppDynamics. Discover a structured approach to efficiently identify, investigate, and resolve security incidents by leveraging the powerful integration and navigation capabilities of these tools.   Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

[Register here]. This thread is for the Community Office Hours session on Application Performance Monitoring (APM): Ask me Anything on Tue, January 20, 2026 at 1pm PT / 4pm ET.    Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics.   What can I ask in this AMA? How can I best use Call Graphs? How do I use Service Grouping? Where can I find APM utilization dashboards? Anything else you’d like to learn!   Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here).    Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants.   Look forward to connecting! ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help.  If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.   SECURITY Tech Talk | Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, Investigation, and Response November 6, 2025 at 11am PT Join Splunk experts for an engaging and interactive Tech Talk, showcasing what you need to know before you upgrade and how: SOC teams should expect a new workflow to triage alerts and run investigations. SOC analysts will enjoy a native integration throughout the triage and investigation workflow with Splunk SOAR. The terminology across the UX has been aligned to the Open Cybersecurity Schema Format. Splunk Enterprise Security 8.x will support backward compatibility for most data in Enterprise Security including data in existing indexes. Security engineers and Splunk administrators will need to take action to leverage the latest innovations and features powered by ES 8 and Splunk SOAR. Office Hours | Splunk Enterprise Security - the AI Powered SecOps Platform November 18, 2025 at 11am PT What can I ask in this AMA? What is different in the latest Splunk Enterprise Security, the AI powered SecOps Platform? Why upgrade to Enterprise Security 8 and why now? What are upgrade considerations and prep work? What do I need to know as a SOC Analyst, Detection Engineer, or SOAR engineer before and after my upgrade to Enterprise Security 8? What is the difference between Enterprise Security Essentials and Enterprise Security Premier? Anything else you'd like to learn!     OBSERVABILITY Tech Talk | Splunk Observability for AI   November 5, 2025 at 11am PT In this session, you will learn how: Splunk's agentic, AI-powered observability ties business context to telemetry, turning insights into improved reliability and reduced toil. To monitor the quality, accuracy, security, and cost of LLM and agentic applications to ensure they are operating as intended. To pinpoint noisy neighbors and troubleshoot issues of resource contention and unmet workload demands to respond to performance threats, degradations, and inefficiencies in real-time. Office Hours | Observability: Splunk IT Service Intelligence (ITSI) November 19, 2025 at 11am PT What can I ask in this AMA about ITSI? How can I incorporate ITSI's AI-powered features like EventIQ to help reduce alert noise? What kinds of Executive Dashboards can I build to visualize the health of the business? How can I respond to issues faster with features like Episode Summarization? Anything else you’d like to learn!     PLATFORM Office Hours | Platform: Data Management & Federation November 20, 2025 at 11am PT What can I ask in this AMA? How do Edge Processor/Ingest Processor and Federated Search for Amazon S3 work together? Can I get a demo? How can I configure Edge Processor in Splunk Enterprise (on-prem)? How can I onboard data from any data store or end points? How does Splunk enable data federation across Amazon Security Lake (ASL) and S3? What tools are available to me? How can I optimize my Edge Processor or Ingest Processor SPL2 pipelines? Anything else you’d like to learn!     APPDYNAMICS Webinar | AIOps and Splunk AppDynamics Anomaly Detection November 26, 2025 at 10am CET Customers will learn how AppDynamics Anomaly Detection enhances visibility across applications and services by automatically highlighting abnormal behavior, accelerating troubleshooting, and improving operational efficiency. ... View more

Register here.  This thread is for the Community Office Hours session on Splunk Observability Cloud - Synthetic and Real User Monitoring (RUM) on Tuesday, Dec 9, 2025 at 11 am PT / 2 pm ET.   Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk products and use case topics.    In this session, we will focus on Digital Experience Monitoring, specifically Real User Monitoring (RUM) and Synthetic Monitoring. Bring your questions and get direct insights from the team.   What can I ask in this AMA? How do I get a more complete view of the user experience on my app or website? How do I correlate front and backend investigations? Can you give me tips on proactively finding and fixing performance issues? How can I gain insights into user engagement and behavior? Anything else you'd like to learn!   Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here).    Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants.   Look forward to connecting! ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you! What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource. OBSERVABILITY Tech Talk | Observe and Secure All Apps with Splunk October 14, 2025 at 1O1am PT In this session, you will learn how to: Detect and protect against runtime attacks in real-time—from common exploits to sophisticated zero-day threats like the recent Shai Hulud Supply Chain Attack—directly within your applications. Prioritize threats based on actual business risk and impact, moving beyond simple severity scores to focus on what truly matters. Arm your application and security teams with actionable intelligence delivered straight to the Splunk tools you already trust. AppDynamics Expert Insight Series | Expand AppDynamics Repsonse and Alert Functionality with Webhook Integrations October 16, 2025 at 12PM PT Discover how to: Streamline alert and response practices with Splunk AppDynamics Integrate with leading incident management and communication platforms using webhooks, with a live demo on setting up targeted notifications for faster, more effective responses. Tech Talk | Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot faster October 21, 2025 at 11am PT We’ll cover two powerful, free integrations available to all joint Splunk Observability Cloud and ThousandEyes customers: Visualize global user experience and network health together to isolate issues faster Drill from synthetic tests into backend traces with just a few clicks Correlate application traces with network telemetry to uncover the true root cause Tech Talk | Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform October 27, 2025 at 11am PT Join this Tech Talk to learn how to: Gain a unified view of IT health using Splunk's powerful data platform Integrate Splunk alerts with Event-Driven Ansible Use Event-Driven Ansible to design your desired response to a given IT event or incident Apply this solution to key operational challenges Apply technical resources to get started Tech Talk | Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM October 28, 2025 at 11am PT Here’s what you’ll learn: OpenTelemetry (OTel) Integration Observability & Monitoring for Kubernetes Infrastructure Faster Incident Detection & Resolution (MTTD & MTTR) Traffic Pattern & Release Impact Analysis Infrastructure Optimization & Scalability How to Be Awesome at Splunk AppDynamics Query Language (ADQL) #2: Splunk AppDynamics Data Collectors and ADQL Searches   October 28, 2025 at 12PM PT Building further on the foundation of our 1st ADQL session, we'll: Add data collectors into the mix to show how to correlate even more business context with analytics! Learn how to use the values customers enter (which are often specifics not normally captured by OOTB observability agents) to dig deeper into trouble shooting scenarios. Focus on capturing meaningful relational context that impacts or directly influences the bottom line of a business. (IE loan amounts, shopping cart values, regional patterns, etc) PLATFORM Office Hours | Splunk 10.0: Your Guide to a Smooth Upgrade Journey October 2, 2025 at 1pm PT What can I ask in this AMA about the next Splunk upgrade? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Office Hours | Platform: Splunk Cloud Migration October 23, 2025 at 11am PT What can I ask in this AMA? What are the primary benefits realized from moving to the Splunk Cloud Platform? What are the essential steps to prepare an on-prem Splunk environment for cloud migration? What are the key approaches and considerations for a successful cloud migration? How can I lower the Total Cost of Ownership (TCO) with the Splunk Cloud Platform? How can users optimize Splunk performance with the Splunk Cloud Platform? What are the key management differences between an on-prem and SaaS-deployed environment of Splunk? What are the different migration engagement models (i.e. self-service, partner-led, services-led)? Anything else you'd like to learn! ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.   SECURITY Tech Talk | Operationalizing TDIR: Building a More Resilient, Scalable SOC August 13, 2025 at 11am PT In this Security Tech Talk, we’ll explore: How to operationalize automation to reduce manual effort and alert fatigue What it takes to build context-driven investigations with visibility across hybrid environments Why enriched asset, identity, and threat intel data are critical for prioritizing response Practical ways to modernize legacy SOC workflows—without ripping and replacing your existing stack Office Hours | Enterprise Security August 20, 2025 at 1pm PT What can I ask in this AMA? What are the latest updates in Splunk Enterprise Security? How can I implement Risk-based alerting (RBA)? How can I utilize Threat Intelligence Management and Cisco Talos for better context? How do I access the latest out-of-the box detections? Which Splunkbase apps and add-ons are recommended for Splunk Enterprise Security use cases? Anything else you’d like to learn! Tech Talk | Leveraging Automated Threat Analysis Across the Splunk Ecosystem August 28, 2025 at 11am PT In this session we’ll cover: An overview of Splunk Attack Analyzer and its automated threat analysis capabilities Examples of how you can use these automated threat analysis capabilities alongside Splunk Enterprise Security and Splunk SOAR Resources to help you make the most of Splunk Attack Analyzer in combination with other Splunk products. OBSERVABILITY Office Hours | AppDynamics August 21, 2025 at 11am PT What can I ask in this AMA? What are the latest updates in AppDynamics? How can I use AppDynamics Business iQ to monitor critical business metrics? How can I deploy AppDynamics Agents in different settings? How can I use AppDynamics Secure Application to ensure applications are secure and high-performing? What are best practices for crafting AppDynamics Query Language (ADQL) queries? Anything else you’d like to learn! PLATFORM Office Hours | Splunk Search August 19, 2025 at 11am PT What can I ask in this AMA? How can I optimize this search query so it runs faster? How do I translate my question into SPL? What are common use cases/prompts for the AI Assistant for SPL? How do I set up federated search for Amazon S3? How do I convert my SPL into SPL2? How do I create an alert/visualization/dashboard from my search? Anything else you’d like to learn! Tech Talk | Introducing Splunk 10.0 August 21, 2025 at 11am PT Key Takeaways Get an exclusive look at the next version of Splunk Enterprise 10.0 and Splunk Cloud Platform 10.0 Discover new features and functionalities designed to make your workflows faster, easier, and more efficient. Review upgrade readiness strategies to ensure a smooth and seamless transition to the latest version. ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource. OBSERVABILITY Office Hours | Splunk Infrastructure Monitoring June 17, 2025 at 1pm PT What can I ask in this AMA? What are some enhancements to the Kubernetes Monitoring experience in Splunk IM? How do I use and customize Kubernetes navigators? What are best practices for optimizing Kubernetes alerts and troubleshooting workflows? Is there a way to view Kubernetes logs correlated with metrics? What are some top services that I should be monitoring? Anything else you'd like to learn about! PLATFORM Office Hours | Platform: Federated Data Management June 18, 2025 at 1pm PT What can I ask in this AMA? How do Data Management, Federated Search, and Federated Analytics work together? Can I get a demo? How can I optimize my data design according to its use case (detection, investigation, threat hunting, compliance, etc.)? How does Splunk enable data federation across Amazon Security Lake and S3? What tools are available to me? How can I onboard data from any data store or end points? How can I start filtering and routing data with Edge Processor or Ingest Processor? How can I optimize my Edge Processor or Ingest Processor pipelines? Anything else you’d like to learn! ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.   OBSERVABILITY Tech Talk | Best Strategies to Optimize Observability Costs May 6, 2025 at 11am PT We’ll cover how to: Reduce log ingestion for new use cases and optimize licensing​ Centralize pipeline management​ Gain visibility into metric volume and usage to identify waste​ Overcome tool sprawl​ And much more! Office Hours | Data Management in Observability Cloud May 20, 2025 at 11am PT What can I ask in this AMA? What capabilities does Splunk have to balance costs and data volume? How does the Splunk Distribution of the OpenTelemetry Collector help filter out data to reduce ingestion costs? What are some ways that I can scale confidently without breaking the bank? How can I filter, aggregate, and archive data for optimal storage and analytics? Anything else you'd like to learn about! PLATFORM Tech Talk | Mastering Data Pipelines: Unlocking Value with Splunk May 8, 2025 at 11am PT Join this Tech Talk to learn how Splunk can help you unlock the value of your security and observability data by building an effective data management strategy. Understand how Splunk’s approach to federated data management can help you maximize the value of data. Build effective pipelines using our latest SPL2-powered data processing capabilities to collect, transform and route data based on your business needs. Run effective searches on data in Amazon S3 without having to ingest or index data into Splunk. Tech Talk | Advanced Splunk Data Management Strategies May 14, 2025 at 11am PT Join us for an insightful Tech Talk where we explore key learnings and best practices learned from a recent study of SOC practitioners on data management: What are the current challenges with data ingestion? What to think about as you consider data relevance in a finely tuned TDIR practice? What outcomes can you expect by deploying advanced data management strategies? Office Hours | Platform: Splunk + Cisco Integrations May 22, 2025 at 1pm PT What can I ask in this AMA? What Splunk and Cisco integrations are available today? What tools/TAs can I use to integrate my Splunk and Cisco data? How can we ingest ASA, IOS, Meraki, or ThousandEyes data? How can I view and analyze incidents within Splunk ES using Cisco XDR as a data source? How do AppDynamics and Splunk Observability Cloud work together? Anything else you’d like to learn! ... View more

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource. SECURITY Office Hours | Security: SOAR April 16, 2025 at 1pm PT What can I ask in this AMA? What are the latest features of SOAR that I should know about? How do Splunk SOAR Playbooks and Actions integrate with Splunk Enterprise Security? How can I leverage the Automation Rules feature to assign playbooks to detections and automate the process? What are the best practices for developing playbooks, workbooks, and process workflows? How do I implement Guided Automation to further optimize the playbook-building process? What are the best practices for setting up prompts in SOAR? Anything else you’d like to learn! OBSERVABILITY Office Hours | AI Assistant in Splunk Observability Cloud April 15, 2025 at 1pm PT What can I ask in this AMA? How can I use the AI Assistant in Observability Cloud to: Speed up investigations w/ faster root cause analysis and guided troubleshooting Easily uncover key insights and make more informed decisions Lower the learning curve for you and your team with Splunk Observability Cloud Anything else you'd like to ask! Webinar | Drive Business Outcomes with Splunk AppDynamics Business iQ Insights April 23, 2025 at 10am PT In this webinar you’ll learn: Instant business-centric insights: Discover how your applications drive business outcomes. Unified visibility: Learn how you can combine app and infrastructure telemetry with business metrics in a single, real-time view with customizable dashboards. Data-driven results: Quickly identify, prioritize, and resolve issues that have the greatest impact on your business.  PLATFORM Tech Talk | The Latest Cisco Integrations with Splunk Platform! April 24, 2025 at 11am PT Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve been working on solutions for integrating product lines like Meraki and UCS, as well as tools like ThousandEyes and Catalyst Center, helping organizations enhance visibility, strengthen security, and drive resilience. Whether you’re looking to optimize performance, streamline operations, or gain deeper insights, this session is packed with insights you won’t want to miss.   APP DEV Office Hours | Future Proofing Your Splunk Apps: OpenSSL 3 and More April 17, 2025 at 1pm PT What can I ask in this AMA? Why is Splunk transitioning to Open SSL version 3 and when? Which customers will be impacted by the OpenSSL3 upgrade? How can I prepare my Splunk environment and applications for Open SSL3? What tools are dependent on OpenSSL3? What benefits will I get with the FIPS-140-3 certified OpenSSL3 library? What will happen if my app or client using SSL 3.0, TLS 1.0, TLS 1.1 tries to establish a connection with Splunk running OpenSSL3? What will happen to my apps if we ship OpenSSL3, but some apps use TLS 1.0 or 1.1? Tech Talk | Holistic Visibility and Effective Alerting Across IT and OT Assets April 21, 2025 at 11am PT Join this Tech Talk to learn how: To gain complete visibility into all hosts and their potential vulnerabilities, misconfigurations and unpatched components in a single analytics platform. To add Tenable asset and exposure risk context improves alert prioritization. Joint customers use Splunk for Centralized Reporting. ... View more

🍀A new season is on the horizon, and March brings fresh opportunities to grow! Our Community Office Hours, Tech Talks, and Webinars will help you develop new skills, spark your creativity, and connect with like-minded professionals. Whether you’re welcoming spring or just seeking a burst of inspiration, these events have you covered. Explore the details below and make this month count! 🌸  What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you! What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource.   SECURITY Office Hours | Security: Cisco Talos Integration March 19, 2025 at 1pm PT What can I ask in this AMA? How does Cisco Talos threat intelligence integrate with Splunk Security products? What kinds of intelligence are provided by the Cisco Talos integrations? How can I start using Cisco Talos intelligence in my Splunk Security products? Anything else you’d like to learn! Tech Talk | SOC Modernization: How Automation and SOAR are Shaping Next-Gen Security Teams March 26, 2025 at 11am PT Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower SecOps to automate time-consuming workflows, orchestrate investigations, enhance threat detection, and speed up response times. Discover how an automation-first approach to security operations helps teams stay ahead of sophisticated adversaries and adapt to evolving techniques and threats. OBSERVABILITY Office Hours | Debugging Microservices with Observability Cloud March 18, 2025 at 1pm PT What can I ask in this AMA? How do I detect issues with microservices and address them quickly? How do features like Service Centric Views, Tag Spotlight, and Trace Analyzer accelerate the troubleshooting process? How do Observability Cloud and Splunk Cloud/Enterprise work together to enhance troubleshooting capabilities? Anything else you'd like to learn about! Tech Talk | Ask It, Fix It: Faster Investigations With AI Assistant in Observability Cloud March 25, 2025 at 11am PT Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With this new GenAI-powered experience, Splunk users can easily extract insights in Splunk Observability Cloud and accelerate their investigations simply by asking questions using natural language. In this session, we’ll go over: An overview of the AI Assistant and its main functionalities Best Practices for AI Assistant: when and how to use it effectively A demo covering monitoring and troubleshooting examples PLATFORM Workshop | Splunk Data Management Workshop: SPL2 Deep Dive March 4, 2025 at 11am PT Get a technical deep-dive on how to leverage SPL2 in Data Management. Learn how to effectively build pipelines in Edge Processor & Ingest Processor to collect, transform, and route your data like never before. Key takeaways: Learn how SPL2 is leveraged in Edge & Ingest Processor Understand the differences between SPL vs. SPL2 Get key SPL2 commands for filtering, masking, and enriching data Demo walking through common use cases and how to build SPL2 pipelines to process and route data to Splunk or Amazon S3 Office Hours | Splunk AI: Ask me Anything March 20, 2025 at 1pm PT What can I ask in this AMA? How does Splunk use generative AI? What are some common use cases to get started with the Machine Learning Toolkit (MLTK) app? How can Splunk help me monitor and secure my generative AI applications? How do the Splunk AI Assistants keep customer data confidential? How can I leverage ML for anomaly detection? Can I develop and package a custom machine learning model in Splunk? Anything else you’d like to learn! ... View more

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, and Webinars! 🌹 Whether you’re in the Valentine’s Day spirit or simply seeking new inspiration, our engaging events will help you refine your skills and energize your creativity all month long. Check out the details below! ✨  What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource. SECURITY Office Hours | Security: Threat Investigation and Analysis February 19, 2025 at 1pm PT This is your opportunity to ask questions related to your specific Splunk threat investigation, analysis needs and use cases, including: What are the best practices for enhancing threat investigation and analysis? How can I help my SOC save time on those missions? How do I maximize the use of threat intelligence and contextual insights when investigating active threats? Which Splunk tools should I leverage to help optimize and automate the process of analyzing and investigating threats? How can Splunk help me get through phishing investigations more efficiently? How does Splunk Attack Analyzer complement SOAR tools and capabilities? How is it integrated with other Splunk security solutions? Anything else you’d like to learn! Tech Talks | Leverage Cisco Talos Threat Intelligence Across Splunk Security Products February 26, 2025 at 11am PT Join this Tech Talk to learn about these integrations, including: The types of intelligence provided by the Cisco Talos integrations How that intelligence is incorporated into your existing security workflows How to get up and running with the integrations OBSERVABILITY Tech Talks | 3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? February 25, 2025 at 11am PT Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and Trace Analyzer, together with your existing Splunk deployment, can help you get to the leaderboard! Ask questions from product experts, watch demos, and learn more about the product! Key Takeaways How Splunk can help you debug problems in microservices faster Splunk tools that can help you accelerate troubleshooting How to use Splunk Cloud/Enterprise for additional use cases PLATFORM Data Management at Splunk: Applying Your First Pipeline February 18, 2025 at 11am PT Learn how to get started with the Splunk pipeline builders. Follow along to configure your edge nodes in Edge Processor and build a basic SPL2 pipeline to filter, mask, transform, and route data to Amazon S3. Key takeaways: Learn the differences between Edge & Ingest Processor (deployment, architecture, capabilities, use cases, etc.) Edge Processor setup demo SPL2 overview & key commands Demo on building your first pipeline to process and route data to Splunk or Amazon S3 Tech Talks | What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience February 27, 2025 at 11am PT Tune in to What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience and find out how to: Improve operational efficiency and monitor distributed health with Deployment Server Enhance your dashboards with updates to Dashboard Studio, including native version control support and tab interaction experience Understand how Splunk helps increase uptime in SHCs due to lookup out-of-sync issues Maximize visibility with Federated Search for metrics, events, and more! ... View more

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 Whether you're forging new resolutions or simply seeking fresh inspiration, this month's events will help you sharpen your skills and spark your creativity. Check out the details below! 🌟  What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you! What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource. SECURITY Office Hours | Security: Ask Me Anything January 15, 2024 at 1pm PT This is your opportunity to ask questions about your specific Splunk Security needs. Our experts are ready to answer all your questions in our first broad security topic session, such as... How can you get started with Splunk Security better? What are the essential steps? What are the latest innovations in ES, SOAR, Mission Control, SAA, and so on? What are the best practices for implementing security use cases, like incident management, RBA, automation, and so on? What is the best approach to building a unified workflow with ES, SOAR, and other security products? What are Splunk Security's third-party integrations, and how can these tools be configured best? What is the magic of industry frameworks such as ATT&CK, Cyber Kill Chain work within ES and SOAR? Anything else you’d like to learn!   OBSERVABILITY Office Hours | Splunk Application Performance Monitoring January 14, 2024 at 1pm PT What can you ask in this AMA? How can I send traces to APM? How do I track service performance with dashboards? What are some tips for setting up deployment environments? What are AutoDetect detectors, and how can I use them? What are best practices for high-value features like Tag Spotlight and Service-Centric views? How do I set up business workflows? Anything else you'd like to learn!   APP DEVELOPMENT Office Hours | Splunk App Development January 16, 2024 at 1pm PT What can you ask in this AMA? How do we work with REST APIs? What SDKs are available for app development? How should we get started with Splunk UI development? What are some best practices to maintain & evolve Splunk Apps? ... View more

Managing your data effectively often means balancing performance, costs, and compliance. Splunk’s Federated Search for Amazon S3 (FS-S3) helps you do just that. It lets you search and analyze historical or archival data directly in your Amazon S3 buckets without ingesting it into Splunk first. The result? You save on storage costs, shorten time-to-detection, and maintain tighter compliance. Key Benefits Reduced Storage Costs: Keep data where it lives in cost-effective Amazon S3 and query it on-demand—minimizing data ingestion and lowering overall storage expenses. Improved Time-to-Detection: Access and investigate historical data directly in Amazon S3 without rehydrating or moving it. Enhanced Compliance: Keep data in its original location to maintain compliance and streamline governance, only searching it when needed. See Federated Search for Amazon S3 in Action Ready to learn how this transformative capability works? Watch our new video and learn how to integrate Federated Search for Amazon S3 into your existing workflows. Additional Resources Check out the Federated Search for S3 Tech Brief for an in-depth look at technical features. Explore our webinar recording for a guided setup walkthrough and a live demo. Dive into this blog post to learn how to get started with key compliance use cases. Get Started Today Federated Search for Amazon S3 is generally available on the Splunk Cloud Platform and requires a Data Scan Units license for your Splunk Cloud stack. Contact your Splunk sales representative to start using FS-S3 today.  ... View more

Modern business operations are supported by data compliance. As regulations evolve, organizations must continuously adapt their strategies to ensure compliance without sacrificing the speed or accuracy of their analytics.  At Splunk, we help you meet challenges and turn compliance requirements into opportunities for innovation. Two new Splunk Lantern articles showcase how Federated Search for Amazon S3 (FS-S3) can enhance your compliance strategy by unlocking deeper insights, streamlining workflows, and reducing risk. Let’s explore these use cases designed to empower your compliance efforts. Use Case 1: Filtering, Enriching, and Retrieving Data from Amazon S3 with FS-S3 When your organization stores massive volumes of data in Amazon S3, retrieving what you need can feel daunting and expensive. Federated Search for Amazon S3 takes the storage and costs out of this process, enabling you to: Filter and route data directly to Splunk Cloud Platform and Amazon S3 without duplicating it into your environment. Seamlessly retrieve raw data while maintaining cost efficiency and compliance with storage policies. Read how to use FS-S3 to filter and route data, enrich it with Splunk Edge Processor, and extract relevant data from S3. 👉 Dive into the full article Use Case 2: Sending Masked PII Data to Splunk and Routing Unmasked Data to FS-S3 Handling sensitive data, like Personally Identifiable Information (PII), is a delicate balance of protecting privacy while ensuring operational workflows remain uninterrupted. This use case explores how Splunk’s FS-S3 can help you: Mask sensitive data at the source and send it to the Splunk platform for compliance reporting. Route unmasked data directly to Amazon S3 for federated search, enabling secure, targeted analysis when needed. Learn how an organization can mask and route PII data to optimize storage costs while maintaining compliance with their datasets. 👉 Explore the full article Why Federated Search for Amazon S3? Splunk’s Federated Search for Amazon S3 is a game-changer for compliance-focused teams, offering: Historical insights: Work directly with S3 data without time-consuming migrations. Security at scale: Keep sensitive data protected while maintaining compliance with regulations. Cost efficiency: Avoid unnecessary duplication of data and infrastructure. Whether navigating compliance regulations or striving to maximize your storage options, FS-S3 provides the flexibility and power you need to stay ahead. 👉 Take a look at our new video showcasing FS-S3 Start Unlocking New Possibilities Today Explore these use cases to see how Splunk’s FS-S3 can transform your approach to compliance and data management. Ready to get started? Federated Search for Amazon S3 requires a Data Scan Units license for your Splunk Cloud Platform stack. Contact your Splunk sales representative to learn more.  ... View more

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! 🎁 Whether you’re decking the halls or cozying up by the fire, we’ve got the perfect way to learn and connect this month. Check out the details below! 🌟  What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where participants can ask questions and engage with technical Splunk experts on various topics. Whether you're just starting your journey with Splunk or looking for best practices to take your deployment to the next level, Community Office Hours provides a safe and open environment for you to get help. If you have an issue you can’t seem to resolve, have a question you’re eager to get answered by Splunk experts, are exploring new use cases, or just want to sit and listen in, Community Office Hours is for you!   What are Tech Talks? Tech Talks are designed to accelerate adoption and ensure your success. In these engaging 60-minute sessions, we dive deep into best practices, share valuable insights, and explore additional use cases to expand your knowledge and proficiency with our products. Whether you're looking to optimize your workflows, discover new functionalities, or troubleshoot challenges, Tech Talks is your go-to resource. SECURITY Office Hours | Splunk Threat Research Team: Security Content December 11, 2024 at 1pm PT This is an opportunity to directly ask members of the Splunk Threat Research Team your questions, such as... What are the latest security content updates from the Splunk Threat Research Team? What are the best practices for accessing, implementing, and using the team’s security content? What tips and tricks can help leverage Splunk Attack Range, Contentctl, and other resources developed by the Splunk Threat Research Team? Any other questions about the team’s content and resources! OBSERVABILITY Office Hours | Kubernetes Observability December 10, 2024 at 1pm PT What can you ask in this AMA? How do I use and customize Kubernetes navigators? What are best practices for optimizing Kubernetes alerts and troubleshooting workflows? Is there a way to view Kubernetes logs correlated with metrics? How do I review Pod status? How do I monitor Kubernetes resource limits? Anything else you’d like to learn! PLATFORM Office Hours | Awesome Admins: Running a Healthy Splunk Platform Environment December 12, 2024 at 1pm PT What can you ask in this AMA? What should I be looking at as a Splunk Cloud or Splunk Enterprise Admin, and why? What are some best practices for using workload management? How can I set up a scalable architecture? What are some best practices for monitoring system health with the Cloud Monitoring Console? What are some tips for managing and balancing disaster recovery? Any best practices for managing large numbers of users? Which admin tasks should I be streamlining with ACS? Anything else you'd like to learn! ... View more

We’re excited to introduce two powerful new search features, now generally available for Splunk Cloud Platform customers globally. Federated Search for Amazon S3 and the Splunk AI Assistant for SPL app are Splunk’s latest innovations to enhance search functionality, streamline data access, and drive more effective insights.  Let’s dive in! Federated Search for Amazon S3  Federated Search for Amazon S3 lets you search data stored in Amazon S3 directly from Splunk Cloud Platform without the need to ingest it first. You can now access large amounts of historical data cost-effectively and efficiently, making it easier to gain insights from your data faster. Key Benefits Reduced Storage Costs: Instead of ingesting all your data into Splunk, Federated Search lets you access data stored in Amazon S3 directly.This enables you to save significantly on storage costs by keeping your data in cost-effective Amazon S3 buckets while still allowing Splunk to query it.  Improved Time-to-Detection: Perform investigations directly on historical data stored in Amazon S3, without the time-consuming process of rehydrating or transferring it into Splunk. This allows for quicker detection and response, especially for archival or low-value data that may not need to be stored in Splunk continuously. Enhanced Compliance: Federated Search lets you keep your data where it is for investigations that require as-needed access to historical, archival, or low-value data and achieve better control over compliance and security.  Additional Resources Review the Federated Search for S3 Tech Brief to learn more. Watch this webinar recording to see how these features can transform your Splunk workflows. Learn how to set up Federated Search for Amazon S3, when to use it, and experience a live demo.  Take a look at this Lantern article to learn how to use Federated Search for Amazon S3 with Edge Processor Ready to get started? Federated Search for Amazon S3 requires a Data Scan Units license for your Splunk Cloud Platform stack. Contact your Splunk sales representative to learn more.  Splunk AI Assistant for SPL App The Splunk AI Assistant for SPL app allows you to generate and explain Splunk Search Processing Language (SPL) queries using natural language. Leverage the power of generative AI to write, learn, and understand SPL more efficiently. New to Splunk? You can now onboard and learn Splunk quickly while reducing the burden on Splunk Admins to answer questions. Experienced user? You can get a head start by leveraging the power of generative AI to get your job done even faster.  Key Features (watch it in action) Quickly generate SPL from natural language: The AI Assistant translates your natural language prompts into working SPL queries, drastically reducing the time needed to write queries.  Understand SPL with ease: Struggling to understand an SPL query? Break it down into easy steps with a detailed explanation of how the query works, what it does, and the results it generates. Interactive help with Splunk Docs integration: Ask questions and explain concepts about SPL features and concepts directly in the app, with responses powered by AI and Splunk Docs integration. Ready to get started? Simply complete the user agreement here to get provisioned for the app, then head to Splunkbase to download the app and install it on your activated cloud stack. Please reach out to mlsupport@splunk.com with any questions or feedback. Upcoming Search Events Check out the event below and register now to secure your spot! Ask the experts Office Hours: Splunk Search & New SPL Innovations | Wed, Nov 21, 2024 at 1pm PT: Ask the Experts in this special session where experts will begin by showcasing the latest innovations in search. Join us to ask questions and get live, personalized guidance from technical Splunk experts. Tech Talk: Generative AI for SPL - Faster Results| Tues, Oct 29, 2024 at 11am PT: Join this technical deep dive webinar to learn about Splunk’s differentiating approach to GenAI, get a technical review of the LLM under the hood, watch a live demo of the AI Assistant, and learn how to activate it. Happy Splunking! The Splunk Search Team ... View more