Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release includes enhancements for both analysts and admins, helping you further your organizational progress toward digital resilience.  Gain Comprehensive Visibility See Observability Cloud Application Service Graph views in Dashboard Studio: Leverage Observability Cloud purpose built views like application service maps alongside existing SPL powered dashboards in Splunk Cloud Platform  in real time. Publish Dashboard Studio dashboards: Extend visibility for non logged in users. Favorite Dashboards: for easier and faster access to knowledge objects and insights discovery. Optimize search performance when SearchResultsInfo is large: Improve system efficiency. More easily collect telemetry related to execution of code by apps: Extended observability in existing nsjail.  Expanded support for eval functions with sdselect command: New functions enhance data transformation and usability. Create and use filters on metric based charts: Without the need for multiple charts in the same dashboard creating a consistent and seamless experience across log and metric based content to speed up dashboard creation. Deliver a More Resilient Platform Offering Job Manager Page: A new, more usable experience with access to modern frameworks and technologies. Expanded Federated Search commands: New “mcollect,” “send alert,” and “sendemail” commands. Maximize Your Data Value Data visibility delegation: Admins can now delegate fine grained admin level management of specific saved search knowledge objects (KO) to defined users, giving fine-grained access to the right data to the right stakeholder. Seamless Observability For Splunk Cloud Platform customers who also have Splunk Observability Cloud, included below are the most recent enhancements that were announced: Observability Cloud Service Map Graph in Dashboard Studio: You can now visualize all your services alongside SPL-powered and metric dashboards by bringing application service graphs from Splunk Observability Cloud into Dashboard Studio. Link Observability Cloud Metric Filters in Dashboard Studio: we’ve made some UI changes so you can more easily filter your metrics in Dashboard Studio with a new drop-down functionality. Link Related Content configured via Unified Identity: you can now use Unified Identity to set up Observability Cloud Related Content in Splunk Cloud, whenever your Observability Cloud and Splunk Platform share the same regions. Link   Check out the 9.3.2411 release notes for additional details.    ... View more

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can benefit from: Dashboard Studio email exports, the new ability to schedule email exports from the Actions dropdown. Related Content linking Splunk Cloud Platform with Splunk Observability Cloud, the new ability to preview Splunk Observability Cloud infrastructure and application data related to an event investigated in the Splunk Cloud Platform Search and Reporting UI. Admins can benefit from: Field Filtering to limit access to confidential information by redacting or obfuscating fields in events within searches, with optional role-based exemptions. New ability to enable Okta as an IDP to automatically de-provision deactivated users in Splunk. Access to Ingest Actions on Splunk Cloud Platform for Google Cloud, including ‘filter’ ‘mask’ and ‘set index’ capabilities.  An improved Federated Search experience allowing customers to turn on/off a federated provider and an improved Data Scan Unit (DSU) consumption experience when running fixed parameter settings with absolute time filters. Enhanced Search Telemetry for Subsearches enabling Splunk support and engineers to more quickly diagnose and resolve issues related to subsearches. Check out the full release notes for more details. Python 2 is in the process of deprecation and soon will no longer be available in coming releases. jQuery v3.5 library is now set as the platform default; prior jQuery libraries are no longer supported. ... View more

Splunk is pleased to announce the latest enhancements to Edge Processor that will help to optimize your data management needs to filter, mask, and route more intelligently. These include support for Lookups, RawHec and Cryptographic Functions. Enhanced HEC capability, now with RawHEC: To complement the earlier release of data ingest and export using HTTP Event Collector (HEC,) Splunk Edge Processor can now receive events via a raw HEC endpoint.  Third-party cloud services can send data to Splunk without having to conform to a Splunk specific format or account for the inability to change code formats with an authentication token. That means you can push more data into Splunk, at a high bandwidth, and with control over data schema. To learn more, check out Splunk Docs. Enhanced Masking with Cryptographic Functions: Support for cryptographic functions builds on the masking capabilities in Edge Processor, and are necessary to ensure data integrity and confidentiality before it leaves your network boundaries. Where previously you could only redact data using Edge Processor, now you can hash data of your choosing, and perform analytics on top of it. For example, you might hash sensitive data like a credit card number before that data streams to Splunk platform; and you may still want to know how many transactions happened using that credit card over the past month. Now you can generate new insights and value into your data. New Lookups: Edge Processor now delivers support for Lookups that enables users to perform better data enrichment and in turn, to make more informed decisions about the data before its indexed.  This means that you can now identify which device failed but not in the event rather saved in another file. You can now erich data further up in the pipeline before indexing to accelerate detection, and you can append information to an event and write an event as an original event, without having to do additional research. For more about Splunk Edge Processor, including plans to support additional sources, destinations, and new functionality, see release notes and documentation.  And be sure to join the Slack user group #edge-processor to get real-time support from the Community.  ... View more

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can benefit from: Updates to the data sets UI to improve the overall usability and accessibility  Dashboard Studio improvements:  New ability to conditionally show or hide panels in Grid layout New option to select Dashboard Studio when saving reports to dashboards Admins can benefit from: Zero downtime upgrades for SHC Victoria stacks, allowing search continuity for short and long-running searches during upgrades and rolling restarts New Workload Management rules with a predicate search_time_range to reduce the impact of searches over large amounts of data Decentralized search telemetry collection, increasing efficiency, integrity (completeness), and reliability of search telemetry while freeing up Search Head capacity Improved role based security for every search using Access Control List (ACL)  An update to Splunk Secure Gateway to allow turning on/off mobile notifications for Alerts and Reports and resizing of the SSG opt-in window enabling mobile users to opt-in from their mobile device during login Private Connectivity now available for Splunk Cloud Platform search capabilities and UI access over private endpoints through AWS PrivateLink for PCI, HIPAA, IRAP, and GovCloud offerings Check out the full release notes for more details. Python 2 is in the process of deprecation and soon will no longer be available in coming releases. jQuery v3.5 library is now set as the platform default; prior jQuery libraries are no longer supported. ... View more