From Network Engineer to Building Agentic AI for Splunk Eduard Lekanne has been architecting technology solutions for over 30 years, beginning his career as a network engineer in 1994. His deep curiosity about how applications perform across networks led him from early log analysis with Perl and Python to discovering the power of Splunk Enterprise—a turning point that fundamentally transformed his approach to data analysis. Since going independent in 2009, Eduard has earned Splunk’s highest certifications and specialized in IT Service Intelligence (ITSI). He has been publishing Splunk apps since 2019. Today he builds and sells Adjutant AI through his own company, ITMIP BV, under the brand The Dutch Data Difference, designed for organizations in government, finance, healthcare, and critical infrastructure that cannot allow their data to leave their own environment. Building Smarter Splunk Apps with AI Eduard’s journey with Splunk began in 2014 at Rabobank, where he built deep expertise in both Splunk Enterprise and Splunk Cloud Platform. Today, he develops apps that integrate seamlessly with IT Service Intelligence (ITSI), Enterprise Security, and the Machine Learning Toolkit. One of his standout projects is Adjutant AI, previously released as AI Workbench, a native agentic AI platform that runs entirely inside the customer’s own Splunk deployment. First revealed publicly at Splunk GO in Hilversum and now available on Splunkbase, it demonstrates how agentic AI can automate real operational workflows, from ITSI root cause analysis and service investigations to threat analysis, forecasting, and anomaly detection, without any data leaving the customer's environment. Eduard’s work reflects a firm conviction that AI in regulated environments has to be governed, auditable, and owned by the customer. Adjutant AI: Agentic AI That Stays Inside Your Environment   Adjutant AI is a native Splunk app that runs entirely inside the customer’s own deployment. No data leaves the environment, the customer chooses the model, and every action an agent takes is governed by existing Splunk roles and recorded as an auditable event. It generates validated searches, dashboards, alerts, and machine learning workflows from natural language, and it can also execute multi-step workflows autonomously, producing results that reviewers can inspect, validate, and reproduce. Building that required designing AI agents that operate entirely within Splunk's native security model, respecting RBAC, audit logging, and customer-selected LLMs. Built for both security and IT operations teams, Adjutant AI streamlines critical work such as ITSI root cause analysis, service investigations, threat investigations, phishing triage, MITRE ATT&CK analysis, and anomaly detection. Unlike generic AI tools, it validates results against the user’s actual Splunk deployment, so responses are accurate, grounded in real data, and traceable back to the search that produced them. The inspiration for Adjutant AI came from years of hands-on experience. Eduard recognized that many customer challenges were rooted in data complexity, driving him to build a platform that makes Splunk more approachable while ensuring customers retain full control over their data, models, and governance. It works with the models and toolkits an organization already trusts, including the Splunk AI Toolkit and Cisco’s Deep Time Series Model, rather than tying anyone to a single provider. Building this as a founder has been both rewarding and demanding. Beyond writing code, Eduard owns the entire product lifecycle, from design and testing to marketing and customer support. His goal remains clear: helping organizations extract more value from Splunk while keeping ownership of their data, their roles, and their model. Eduard’s Advice for New Splunk App Developers For developers just starting their journey, Eduard’s advice is simple: Build something you believe in. Splunk Enterprise is a powerful platform with endless opportunities for innovation, and every developer brings a unique perspective that can solve real-world problems. He recommends taking full advantage of Splunk’s built-in capabilities, such as authentication, role-based access control (RBAC), KVStore, and secure credential storage. In addition, designing with Splunk Cloud compatibility in mind from the start ensures your app reaches the widest possible audience. Just as importantly, Eduard emphasizes building trust. "Be transparent when data is incomplete, test with real-world datasets, and run AppInspect early and often throughout development," he suggests. His final piece of advice? Don’t be afraid to think creatively. Innovation starts with curiosity and the confidence to turn ideas into reality. Life Beyond Code: Finding Balance in Nature When he isn’t developing apps, Eduard finds balance in the great outdoors. Living in a wooded area, he is constantly working on new projects, whether that's gardening, wood carving, painting, or maintaining his property. He also cares for three Friesian horses, a hands-on responsibility that keeps him busy year-round. For Eduard, working with his hands provides the perfect balance to the digital world, helping him recharge, stay grounded, and return to his development work with a fresh perspective. We’ve added a new "AI Champion" category to the series! Want to be the next one featured? Nominate yourself or a peer here: Submit your nomination Keep the good stuff coming. Here’s how to subscribe to this blog — and stay in the loop on the topics that matter to you.   ... View more

Another quarter, another wave of innovation. From complex integrations to pushing the limits of what’s possible with Splunk, your technical brilliance drives our ecosystem. Thank you for being the heartbeat of our community—let’s dive into this quarter’s highlights.  Splunk Developer Day: A Milestone Event  On May 13, 2026, we hosted our virtual Splunk Developer Day, focusing on the practical tools you need to build, scale, and monetize on the Splunk platform today. If you couldn’t join us live, here are the key takeaways:  Platform Extensibility: Learn how to build scalable, repeatable business outcomes using structured extension points rather than one-off integrations.  Modern TA Tooling: Standardize your workflow with the UCC framework and our new gold-standard self-assessment checklist for reliable data collection.  AI-Enhanced Quality: Speed up development with AI-powered root-cause analysis in AppInspect and use the new Splunkbase app analyzer to optimize your listing metadata.  Monetization: Ready to go to market? Check out our new guide on the developer portal for navigating the path to paid apps on Splunkbase.  If you missed the live event, you can catch up on all the demos and implementation details via our official event recap blog and the full YouTube event playlist.   Mastering the Agentic Loop: Agents in Apps (Python SDK)  One of the standout sessions focused on the intersection of automation and intelligence. Michael Szebenyi, Engineering Product Manager at Splunk, teamed up with Guilhem Marchand, Founder & Director of TrackMe Limited, to dive deep into the Splunk SDK for Python Agentic Loop. With the agentic loop built into the Python SDK, apps can now deploy agents directly within the Splunk Platform—whether it’s an assistant panel to guide users or running headless tasks behind the scenes. You can watch their full presentation here.  Where to start: Add a contained AI chat panel or a read-only background agent to a non-production app to help explain investigations or enrich search results.  Get started: Splunk Enterprise SDK for Python.  The Future of AI: App MCP Tools  Apps are the primary way Splunk insights are packaged for customers, and the Splunk Model Context Protocol (MCP) allows these apps to share insights easily with LLMs for analysis and action. In this session, JD Radadiya, Product Manager for Splunk AI, demonstrated how apps can create App MCP tools from custom REST endpoints and saved searches. These tools are exposed to the Splunk MCP server via a new tools.conf file, which includes a stanza per tool to define the name and description shared with agents and LLMs. Catch the recording of JD’s insightful session at this link.  Where to start: Choose a useful, safe, and easy-to-describe saved search or REST-backed workflow to package as a callable tool.  Get started: Add MCP tools to your Splunk app.  Developer Spotlight: Mika Borner  We featured Mika Borner, founder of Datapunctum AG, whose journey began by winning Splunk’s first "Apptitude App Challenge." His project evolved into Alert Manager Enterprise, a robust tool that combats alert fatigue with advanced workflow and synchronization capabilities. Mika advises developers to focus on real-world pain points and master Python and React to build impactful solutions. Read his full story in our Spotlight blog and check out his app on Splunkbase.  Interested in being our next Developer Spotlight? Let us know by filling out this form!  Deep Dives: Tech Talk Highlights  This quarter also featured some fantastic technical deep dives. If you are looking to sharpen your skills, be sure to watch these on-demand Tech Talks:  Collaboration Experience as an Early Warning of Hidden Network Issues: Learn how to correlate collaboration telemetry with infrastructure data to identify and resolve network issues before they impact business outcomes.  Automating Threat Operations and Threat Hunting with Recorded Future: Discover how to support Autonomous Threat Operations by running repeatable, intelligence-driven hunts that reduce manual effort and accelerate detection.  Join Us at .conf26!  The momentum doesn't stop here. We are already gearing up for .conf26 and we want you there with us! It’s the perfect opportunity to connect with fellow developers, learn from experts, and see the latest in Splunk innovation.  Register for .conf26:  Secure your spot today.  Learn what’s happening at the Builder Bar  Explore the Developer Track: Check out the session catalog to plan your schedule.  Visit the Builder Bar:  Don't forget to stop by the Builder Bar at the Pavilion to get hands-on support and chat with our engineering teams.  We can’t wait to see what you build next. Keep the conversation going in the forums, share your projects, and continue to challenge the status quo. Happy coding!  ... View more

From Hackathon Winner to Enterprise Leader    Mika Borner, CEO and Founder of Datapunctum AG, has been involved with the Splunk Platform since 2006, transitioning from a customer and consultant to an app developer by 2010. His early technical work included creating custom automation for incident response, which served as a precursor to modern SOAR solutions.   In 2014, Mika and a colleague won Splunk’s first "Apptitude App Challenge" hackathon with the initial version of Alert Manager. What started as a competitive project quickly gained traction as an open-source tool, fueled by community feedback and the growing need for better incident management. Following the project's success, he founded Datapunctum in 2019. By applying modern development processes and a fresh codebase, he transformed a successful community project into Alert Manager Enterprise, a robust solution designed for the rigors of modern IT and Security Operations.    Elevating Splunk Workflows: From Alerts to Action  Alert Manager Enterprise, designed for Splunk Enterprise and Cloud, was built to address a universal challenge: alert fatigue. By turning raw Splunk alerts into structured, actionable events, the platform provides workflow capabilities—such as status tracking, prioritization, and bidirectional synchronization with tools like Jira and ServiceNow—directly within the Splunk interface. For Borner, the goal is to empower IT Operations, Security Operations, and compliance teams to mitigate alert fatigue and streamline incident management entirely within the Splunk environment.     From Pain Points to Products: A Developer’s Guide to Splunk Success  When asked about his development process, Mika emphasizes the power of the Splunk Platform, particularly the flexibility of KVStore and the modular alerts framework.   In his own words: “What I really like about building on Splunk is how much you already get out of the box.”  His team at Datapunctum relies on a modern stack, including Python, TypeScript, and GitHub Actions, while leveraging AI coding assistants to accelerate prototyping and refactoring.  For aspiring developers, Mika advises focusing on real-world pain points, engaging with the Splunk Community, and mastering the essentials. He strongly recommends a solid grasp of Python for backend logic and React for modern, responsive UI development. He also suggests beginning with open-source projects to validate ideas and gather feedback before committing to larger enterprise solutions.  Coding on the Road: Mika’s Off-the-Grid Adventures  When he isn't driving innovation at Datapunctum, Mika finds balance in physical activity and travel. He is an avid gym-goer and cyclist, and he enjoys spending time in his RV. He even finds time to upgrade his vehicle with solar and Starlink technology, allowing him to work off-the-grid from anywhere in the world.  Want to be our next Developer Spotlight? Let us know by filling out this form!  ... View more

Splunk Developer Day was packed with product and platform updates for developers building in the AI era.  Hosted by Splunk Community HQ on May 13, 2026, the event showed how Splunk, a Cisco company, is helping developers bring agentic workflows, forecasting, and modern visualization experiences into apps and workflows on the Splunk platform.  This post focuses on the major product announcements and technical updates from the day. For the community recap, including platform extensibility, monetization, technology add-ons, App Inspect, Splunkbase, and community programs, see the companion recap post.  MCP tools in apps for the Splunk platform  One of the clearest themes of Developer Day was this: if AI agents are going to work across systems, apps need to be reachable as tools.  The Apps with MCP Tools session introduced developers to exposing app functionality as Splunk MCP tools without building and maintaining a standalone MCP server. The session highlighted built-in platform pieces such as authentication, rate limiting, tool collision checks, discovery, role-based access controls, monitoring, and admin dashboards. Developers can package MCP tool definitions in apps using files such as tools.conf and tool_input_payload_signatures.json, then expose saved searches or REST endpoints through the Splunk MCP server.  The announcement matters because it gives app builders a more direct path to building agentic workflows. Instead of asking every developer to solve the same infrastructure problems, the platform gives them a place to register useful app capabilities and make them discoverable to AI clients and agents.  This capability is live on Splunk Cloud as of the 10.4 release.  AI agents can now live inside apps for the Splunk platform  Developer Day also covered new additions to the Splunk SDK for Python that let app developers build and deploy agents inside the Splunk app runtime.  The session described a new agentic loop in the Python SDK and a new splunklib.ai package for agent tooling. Developers can use these capabilities to create agents that run behind the scenes, appear as assistant experiences, work inside custom search commands, respond to alerts, or analyze data as it is ingested through modular inputs. The SDK was described as already published on GitHub, with support for connecting to an LLM of choice, including OpenAI API-compatible models.  The bigger idea is simple: agents do not have to sit outside the product experience. They can become part of the app itself, working from the same extension points developers already use.  This is live and is built into the Python SDK and was released with SDK version 3.0.0. It requires Python 3.13  AI Toolkit Agent Builder is in private preview  The Agent Builder session showed how Splunk AI Toolkit is evolving for the agentic era.  Agent Builder was presented as a way to create, test, and deploy agents in minutes. The demo showed a new agentic AI area where users can create agents, connect MCP tools, configure prompts, view agent run history, and invoke agents through SPL, dashboards, or other services. The session also covered future directions, including broader MCP server support, follow-up conversations after an agent run, agent templates, alert and dashboard integrations, and on-premises or hybrid availability.  Agent Builder is running as a private preview right now, stay tuned for general availability!   Cisco Time Series Foundation Model is in public beta  The generative AI forecasting session announced the Cisco Deep Time Series model, a time series foundation model for forecasting, prediction, and anomaly detection.  The model is available in public beta in Splunk software and is available for the open source community. The session noted a Hugging Face 1.0 version released in February, following an earlier preview model in November. Inside Splunk software, the model is delivered through the latest version of AI Toolkit. Developers can also run it outside Splunk software, including on-premises, by downloading the model and pointing their AI Toolkit configuration to it.  This model supports a shift from "detect and respond" toward "predict and prevent." In practice, that means forecasting time series behavior, identifying anomalies, adjusting confidence bands, and giving teams more time to act before issues affect customers.  Dashboard Studio gets a modern custom visualization framework  Dashboard Studio has its own major developer update: a new custom visualization framework introduced as part of Splunk Cloud Platform and Splunk Enterprise 10.4.  The session explained that Splunk Cloud Platform and Splunk Enterprise 10.2 added support for rendering legacy custom visualizations in Dashboard Studio. The new 10.4-era framework goes further, giving developers a modern way to build custom visualizations with updated tooling, a simpler lifecycle, a faster build loop, and a sandboxed iFrame architecture that isolates visualization code from SplunkWeb's global DOM.  Developers also saw a project scaffolding flow, watch mode, build tooling, a dashboard extension API, and an AI-assisted custom visualization demo. The takeaway: Dashboard Studio custom visualizations are becoming easier to build, package, and modernize.  What developers can try next  Together, these announcements point toward a more agent-ready developer experience on the Splunk platform. Developers can expose app functionality as MCP tools, build agents into app workflows, experiment with Agent Builder, try forecasting with the Cisco Deep Time Series model, and create richer Dashboard Studio visualizations with a more modern framework.  Watch the recordings to see the demos, review implementation details, and decide which capability fits the next thing you want to build. And if you learned something cool, don’t forget to exercise those skills and win some prizes at the Community Dashboard Contest and the Splunk Agentic Ops Hackathon. Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to build on the Splunk platform today.  Hosted by Splunk Community HQ on May 13, 2026, the event focused on the real work behind great developer experiences: extending the platform, building reliable technology add-ons, improving app quality, publishing on Splunkbase, and helping developers turn useful apps into sustainable solutions.  This recap focuses on the community and ecosystem side of the day. For more product announcements, see the companion announcements post.  Platform extensibility as the foundation  The platform extensibility talk stepped back and explained how apps for the Splunk platform deliver value in the first place.  The session framed an app as a packaged business outcome: configurations, content, and platform extensions bundled together so a customer can solve a specific problem. The talk focused on the extension side, where code connects to the Splunk platform through structured extension points that Splunk software can recognize, interpret, and run.  That context made the rest of Developer Day easier to understand. MCP tools, embedded agents, custom visualizations, technology add-ons, and App Inspect improvements all build on the same idea: developers need clear, reliable ways to extend the platform without turning every project into a one-off integration puzzle.  Modern technology add-on tooling gets a stronger quality path  Technology add-ons were another practical focus of the day. The modern tooling session framed TAs as the backbone of how data gets into Splunk software, then walked through a more structured approach for building high-quality, reliable add-ons.  The session covered a new gold standard framework and a self-assessment checklist for TA builders. The checklist helps developers evaluate whether their add-ons use UCC, store credentials correctly, include automated tests, validate Common Information Model mappings, support current platform standards, and provide documentation users can follow.  The session also reinforced UCC as the primary framework for modern TA development. UCC uses a single global configuration file to generate the configuration UI, REST handlers, modular input scaffolding, monitoring dashboards, alert action files, OpenAPI documentation, and package structure around a developer's data collection logic.  For developers maintaining TAs, the message was useful and concrete: start with the framework, run the self-assessment, and use the toolchain to catch quality issues earlier.  AI for App Inspect and Splunkbase app analysis are available today  The kickoff included two Splunkbase and app quality updates that are especially relevant for developers publishing apps.  First, AI for App Inspect was described as a recently launched enhancement that embeds AI into App Inspect reports. Instead of only showing failed checks, the AI-enhanced report can explain why a check failed, identify root causes, and point developers toward the lines of code they may need to change. The session also described connecting App Inspect through CLI, API, or MCP so agentic coding tools can check work continuously against App Inspect guidance.  Second, the Splunkbase app analyzer was presented as an AI-assisted way to improve app listing documentation. The tool looks at an uploaded app package and helps generate metadata - including summary, details, installation and troubleshooting for the Splunkbase listing, while leaving the developer in control to review and edit the output. This capability is available today.  Both announcements support the same developer goal: make it easier to ship apps that are easier to review, understand, and maintain.  A new guide for monetizing apps on Splunkbase  The closing session focused on monetizing apps for the Splunk platform and introduced a new guide on the Splunk developer portal.  The guide is the first version of documentation for developers who want to understand how to monetize an app, set up transactions, publish on Splunkbase, and build a more complete go-to-market path around a paid app. Newly launched, this guide is intended to become a living document shaped by developer feedback.  That made a strong close to the day. Developer Day was not only about building apps; it was also about helping developers package, validate, publish, and grow them.  Community announcements for builders  The kickoff also included two community updates:  The Agentic Ops Hackathon is live, with submissions open through June 15, 2026. Developers and practitioners are invited to build solutions across platform developer experience, observability, and security use cases, with $20,000 in cash and .conf26 passes to win as prizes.  The Community Dashboard Contest is also open, giving developers another way to showcase dashboard-building skills and compete for .conf26 passes.  What to watch next  If you build on the Splunk platform, this content is for you. Developer Day showed how much investment is going into the full builder journey: how you extend the platform, how you create dependable add-ons, how you improve app quality, how you publish on Splunkbase, and how you grow from app package to real customer value.  Watch the recordings to go deeper into the demos, examples, and implementation details from each session.  Keep the good stuff coming. Here’s how to subscribe to this blog — and stay in the loop on the topics that matter to you.   ... View more

We are excited to invite you to Splunk Developer Day on May 13th, a full day virtual event of deep-dive technical sessions designed to help you automate workflows, explore the power of MCP tools, and master the art of building agentic Splunk apps.  Why You Should Attend?  Whether you are an app developer, a power user, or a Splunk Partner, this event is packed with actionable insights to help you grow your skills and your business. We are moving beyond the basics to explore the cutting edge of platform extensibility and AI.  What’s on the agenda?  Our sessions are categorized into three primary tracks to ensure you get the most relevant information:  AI & Agents: Get hands-on with the future. Learn to deploy agents, leverage our new AI Toolkit, and harness the power of generative AI for advanced time-series forecasting.  Platform Extensibility: Master the art of extending the Splunk platform. We’ll cover best practices for building advanced dashboards and modernizing your TA development process to ensure your solutions are robust and scalable.  Business Growth: Join us to learn from experienced developers about finding product-market fit, navigating licensing, acquiring customers, and scaling your app—regardless of your current experience level. How to Join  Registration is now open! Once you have registered, you will gain full access to view the detailed session agenda, allowing you to plan your day and choose the topics that matter most to your professional development.  Don’t miss this chance to level up your expertise and help shape the next generation of Splunk apps. We look forward to seeing you there on May 13th!  Register by visiting this link here You can also connect with the Community on the #appdev Slack channel.   Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.   ... View more

Accelerating the Developer Journey: Splunk App Dev Quarterly Roundup Navigating the transition from app development to publication often feels like a bottleneck for many partners and builders. This quarter's highlights showcase how we are embedding AI and direct advisory support to turn that bottleneck into a high-velocity, self-service cycle. Key Takeaways AI-Powered Validation: AI Intelligence Reports and MCP integration now explain and streamline AppInspect failures. Targeted Deployment: New Targeted Application Install (TAI) allows for granular app management across search head groups. Direct Expert Support: The Developer Advisory and Support (DAS) team is now live to assist with technical troubleshooting. Developer Spotlight Series  Our Developer Spotlight Series continues to showcase the "power users" driving innovation in the Splunk Community. In this edition, we feature Guilhem Marchand, Principal Developer & Director at TrackMe Limited. Guilhem leveraged over a decade of hands-on experience to build "TrackMe"—a Splunk-native solution designed to solve real-world operational pain points by monitoring data sources at scale across Splunk Enterprise and Splunk Cloud. Read the blog here.  AI for AppInspect  We’ve announced two major updates to AppInspect that transform the developer experience by embedding AI directly into the validation workflow. These updates introduce AI-powered Intelligence Reports to explain submission failures and integrate AppInspect directly into developer IDEs via the Model Context Protocol (MCP). Our goal is to evolve the app approval process into a transparent, self-service, and high-velocity development cycle. Read the blog here.   Tech Talk: Application management with TAI On January 26th, Splunk experts Gregory Reshetniak and Szymon Kurzępa hosted a Tech Talk to introduce a more flexible way to manage Splunk Cloud Platform apps. With Targeted Application Install (TAI) for Victoria Experience, developers can now specify exactly which search head groups receive specific apps—making it easier than ever to tailor Splunk environments. Watch the session On Demand.  Meet Developer Advisory and Support (DAS) The newly launched Developer Advisory and Support (DAS) team provides Splunk app developers with direct technical expertise and troubleshooting. Through a streamlined intake process, DAS helps partners and builders navigate app packaging, technical best practices, and license fulfillment—ensuring a faster, smoother path from development to publication. Read the blog here. 2025 Year in Review 2025 was a pivotal year for the Splunk App Platform, defined by the centralization of developer resources and the expansion of the Splunk Developer Program. Throughout the year, we focused on reducing friction for builders, fostering a high-engagement community, and deepening our integration with the Cisco portfolio. Our official 2025 Year in Review blog captures the key product milestones, community growth, and strategic integrations that defined this foundational year. Read the blog here.     Join the Splunk App Dev Community Connect with the Community on the #appdev Slack channel by clicking on this link. ... View more

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval process more transparent and efficient: AppInspect Intelligence Reports AppInspect as an MCP tool AppInspect Intelligence Reports: AI-Powered Insights for Faster Approvals When your app doesn’t pass a check during submission, you’ll now receive detailed, AI-generated insights. These reports will help you understand exactly why a check failed for your specific app and provide actionable suggestions to help you resolve issues quickly. Our goal is to reduce back-and-forth communication and help you get your apps approved faster. AppInspect as an MCP Tool: Seamless Integration in Your IDE AppInspect is now registered as an MCP tool, allowing you to assess it directly through your IDE or AI development tool like Windsurf and Cursor.  By configuring AppInspect within your IDE, you can catch issues earlier and leverage AI-powered recommendations without leaving your coding environment. How to get started in your IDE: Install the Splunk AppInspect CLI Configure the Splunk AppInspect CLI as an MCP server in your IDE Get started validating your app using natural language prompts. For detailed instructions, please refer to the public documentation.   This update allows you to streamline your app's validation process with intelligent insights and convenient IDE integration. We encourage you to try these new features and share your feedback! If you any questions or need assistance, please reach out to us at [email protected]. Never miss a new post. Check out this short guide on how to subscribe to the blog and get updates.  ... View more

[Register here] This thread for the Community Office Hours session on Our Comprehensive Guide to SPL2: Navigating New Features and Optimizing Workflows on Thur, Feb 19, 2026 at 11am PT / 2pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? Can you provide examples of how the SQL-like syntax in SPL2 can be used for common data analysis tasks? What is the module editor and how does it help me do my job? What are the expected performance improvements when using SPL2 compared to traditional SPL for large datasets or complex queries? How does the "point-and-click SPL to SPL2 converter" work, and what are its limitations? Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk App Platform. Over the past year, together with our cross-functional partners, stakeholders, and executive sponsors, we achieved milestones that meaningfully advanced our platform and set us up for long-term success. As we look back on the year behind us, we’re proud to share some of the most impactful highlights from 2025—and as we look ahead, we’re even more excited about what 2026 holds for the App Platform. Fostering a Thriving Developer Community & Support Splunk Developer Program launched marking a major milestone in how developers build, innovate, and scale on the Splunk Platform. Designed as a unified home for the developer community, the program eliminates fragmented resources by providing a centralized hub for everything needed to create high-quality apps and integrations. Sign up for the Splunk Developer Program.   Developer Advisory and Support (DAS) is a key new launch for our app developer community. DAS gives Splunk app developers the guidance, licenses, and dedicated support needed to build, troubleshoot, and scale with confidence. Get expert, personalized technical advice to accelerate end-to-end development, resolve issues faster, and ensure your apps align with Splunk best practices—every step of the way. Empowering the Builders: Strengthening the Heart of Our Dev Community  .conf25 Activations: A new record with Builder Bar and 19 DEV track sessions. Community developers received spotlights, interviews, and press coverage. Webinars: Hosted 7 app dev webinars across Tech Talks and Community Office Hours. If you missed one, access them here. Developer Advisory Council (DAC): A group of 50+ members attending quarterly sessions and providing invaluable feedback for the product roadmap. #appdev Community Slack: Grew 9% to 2,100+ active members. Developer Hackathon (Splunk Build-a-thon): Engaged 1,364 participants across 1,231 teams, generating 150+ app ideas with 50+ prototypes. Developer Spotlights: Featured 5 developer spotlights and case studies of our most successful developers. Splunk Community App Dev Learning Path: Launched as a guide for developers to sharpen their skills and elevate their apps. Blogs were developed to promote Cisco integrations, highlighting the successful launch of App Tiering on Splunkbase and strengthening Cisco’s presence through a unified official author representing 11 featured Cisco apps.     What’s Coming in 2026 Empowering our Partner Ecosystem through a new series of Partner Tech Talk editions, highlighting partners who deliver high-quality, turnkey apps on Splunkbase. Review upcoming Tech Talks here. Splunk Developer Day—our first-ever developer event focused on empowering and inspiring developers. Discover new capabilities, explore monetization and AI opportunities, and connect with a thriving, collaborative developer community. .conf26: Join us in Denver from September 14–17. Can’t wait to see you there!   2025 has been a year of remarkable achievements, driven by innovation, collaboration, and a deep commitment to our developer community. We're incredibly proud of what we've accomplished together and are energized for an even more impactful 2026!   Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time on Splunk, Guilhem has seen the platform evolve dramatically — together with his own journey. For the past 7 years, he has been part of Splunk’s Professional Services ecosystem in EMEA as a partner, helping organizations unlock real value and operational visibility from their data.  The Birth of TrackMe  Around 2017, while working on various Splunk implementations, Guilhem identified a recurring challenge: once data was ingested into Splunk, teams often struggled to maintain visibility on data feed quality, availability, and operational health.  That’s how TrackMe was born — initially as an open-source Splunk app designed to help teams track and monitor their Splunk data feeds with ease. It quickly resonated with the community, gaining adoption across organizations worldwide.    From Open Source to a Company   Recognizing the widespread use and value of TrackMe, Guilhem took the next step in 2021 by founding TrackMe Limited in the UK, transforming his “Splunk baby” into a full-fledged product and business. Today, TrackMe empowers Splunk users globally—from the US and Europe to the UK and Australia—with a free community edition and premium enterprise editions. Despite being a small company, TrackMe serves many large organizations, with Guilhem acting as the principal developer and director, driving both the technology and the vision.    What TrackMe Does    TrackMe is tailored specifically for Splunk Enterprise and Splunk Cloud environments. It provides visibility and operational excellence by monitoring, at scale, the availability and quality of data sources — and much more. Over time, the product has expanded beyond feed tracking to include machine learning, field quality monitoring, and advanced workflow management. The app integrates with a growing ecosystem, including Splunk SOAR, Cribl LogStream, Palo Alto XSOAR, and Google SecOps.     High-Level Business Metrics Indicating TrackMe’s Success    TrackMe has consistently maintained a 5-star rating on Splunkbase. Since its inception, it has been downloaded 24,761 times. The company has a successful number of paying customers, including many Fortune 100 clients. TrackMe plays a key role for a diverse range of Splunk customers, spanning on-premise to cloud-based deployments.    Major Costs and Resource Constraints in Building TrackMe    Application Maintenance: Keeping the app updated is challenging due to evolving Splunk technologies, deprecations, and the need for regular updates. Splunk Cloud has improved with fully automated application vetting; however, app developers should remain vigilant of changes to the underlying platform—reflected through upcoming AppInspect requirements–that can impact app compatibility. For applications like TrackMe, this represents a major concern, and it is something that Guilhem is closely monitoring.  Qualification in Splunk Cloud: Developing and qualifying in Splunk Enterprise alone is insufficient; TrackMe releases undergo rigorous qualification in a true distributed Splunk Cloud environment using SCDE.  Technical Resources: TrackMe uses dedicated bare metal servers with custom automation and the Splunk Automator (Ansible-based) to run continuous production environments and create/destroy fresh deployments for testing.  Complex Deployment Factors: Support for FIPS and other complex options requires testing in valid environments. TrackMe ingests its own infrastructure logs and uses custom data generators for testing.    Favorite Developer Tools and Resources for Building Splunk Apps    Cursor AI: Intensively used for continuous development and Pull Request reviews, Cursor AI was fundamental in TrackMe’s transition to React native user interfaces.  Promox VE: Used for virtualization of development environments.  Docker: Containerizes tooling such as Eventgen, Splunk EAM, and Jenkins.  Jenkins: Manages creation, destruction, and maintenance of testing environments daily.  GitHub Actions: Automates CICD pipelines; every TrackMe release is built, qualified, and inspected automatically in fresh containers.  Appinspect API: Integrated into CICD pipelines for Pull Request validation, with custom Python handlers.  Splunk UI: Forms the foundation of TrackMe’s user interfaces.  Splunk UCC Framework: Used since early stages, serving as the backbone of the app.      Major Milestone Achieved    TrackMe has just announced the migration from the legacy JavaScript stack to native React with Splunk UI. There has been extremely positive feedback and a product that has entered a totally different dimension of quality and richness. The goal is to make TrackMe a truly modular, responsive, and future-proof solution for Splunk users worldwide.  Though TrackMe Limited remains a small company, it is built on a decade of hands-on Splunk experience, community trust, and relentless focus on operational excellence. Guilhem is excited about the future of TrackMe and the growing community of Splunk professionals who continue to inspire its evolution.  Want you or your team to be our next Developer Spotlight? Let us know by filling out this form!    Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more

[Register here] This thread for the Community Office Hours session on Splunk 10.0 Is Here: Your Guide to a Smooth Upgrade Journey_AMER on Thur, Dec 11, 2025 at 1pm PT / 4pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn!   Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

[Register here] This thread for the Community Office Hours session on Splunk 10.0 Is Here: Your Guide to a Smooth Upgrade Journey_APJC on Fri, Dec 05, 2025 at 9am JST (Japan Standard Time) / Thur, Dec 04, 2025 at 4pm PT / .   Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics.  What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn!   Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

[Register here] This thread for the Community Office Hours session on Splunk 10.0 Is Here: Your Guide to a Smooth Upgrade Journey_EMEA on Tue, Dec 02, 2025 at 4pm CEST (Central European Summer Time) / 7am PT. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on? Anything else you'd like to learn! Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

Splunkbase Unveils New App Listing Management Public Preview We're thrilled to announce the public preview of the new Splunkbase App Listing Management experience! This release marks a significant milestone, as we complete the Splunkbase evolution by revamping the developer-facing experiences. This is a crucial step in fostering a robust developer community and empowering developers to deliver even higher quality apps for our valued Splunk customers! The Heart of Innovation: Splunkbase Splunkbase is a vibrant ecosystem, home to over 2000+ apps including contributions from Splunk, Cisco, partners, and other 3rd parties. The Splunkbase App Listing Management pages are where developers bring their creations to life, providing details like descriptions, screenshots, troubleshooting guides, installation instructions, and compatibility information. By doing so, developers not only showcase the quality of their apps but also attract more customers to download and install them. Exciting New Capabilities for App Developers These new developer-facing pages introduce several powerful new features designed to streamline workflows, enhance quality, and build developer reputation: 📌 Draft App Listings: Developers can now create app listings and save them as drafts, returning to complete them before publication.  📌  Large Package Support: A game-changer for innovation! Splunkbase now supports app packages up to a massive 2GB, a significant leap from the previous 100MB limit.  📌 Developer Profiles: We're empowering developers to build their reputation within the Splunkbase community.  📌 Visualized AppInspect Reports: When uploading to Splunkbase, AppInspect reports are now visually presented with helpful descriptions for any failing checks. 📌 Fully Automated AppInspect: Say goodbye to long waiting times! The AppInspect process reduces the review time from an average of 5 days to just 5 minutes.  Looking Ahead This revamp of the Splunkbase App Listing Management experience is a testament to our commitment to the developer community. By providing these advanced tools and capabilities, we're not just improving a platform; we're fostering innovation, enhancing app quality, and ultimately, delivering a better experience for all Splunk users. We can't wait to see the incredible apps you'll build with these new features! ... View more

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps  Qmulos started as a scrappy startup with a bold vision: to revolutionize cybersecurity compliance and user behavior analytics. Today, the company has grown into a powerhouse, blending the talents of engineers with diverse backgrounds ranging from finance and gaming to large-scale cybersecurity. At the core of their success is a passionate team pushing the boundaries of Splunk app development, delivering cutting-edge solutions like their flagship Q-Compliance app. These advancements supercharge Qmulos’ business and usage metrics when paired with Splunk. Some of these impressive figures include:  Over 2500 systems, applications, and programs (i.e., accreditation boundaries) managed for compliance;  More than 120 TB of technical compliance evidence automatically collected via Splunk;  Over 700K security controls monitored and assessed; and  Support for more than 20 security and compliance frameworks.  These metrics highlight the extensive scale and automation capabilities Qmulos provides in managing compliance and security posture through Splunk integration. Join us as we spotlight the dynamic people, innovative technologies, and unique culture that fuel Qmulos’ ongoing mission to secure both public and private sector IT environments. Qmulos Scales Up by building a High-Impact Cybersecurity Team The Qmulos team ranges in experience from earlier career engineers to veterans in the industry, ranging from a couple years of experience to decades. As a company, it started as a small scrappy start-up and has grown into an organization with multiple teams focused on delivering mission-critical cybersecurity compliance and user behavior analytics solutions for public and private sector customers. From Finance to Gaming: Qmulos Innovates Qmulos team has a diverse, if not somewhat unconventional history. While most team members had adjacent cybersecurity experience by virtue of developing software in large engineering teams, they have team members who came from backgrounds in financial institution solutions, supply-chain management, and even game and hardware development. Qmulos: Engineering the Future of Splunk Apps Qmulos has been pushing the boundaries of Splunk app development for over a decade. Their products target Splunk Enterprise and Splunk Cloud Platform, creating feature-rich experiences that exercise Splunk’s data collection, search, investigation, alerting, and visualization capabilities. Trying to stay on the cutting edge of Splunk’s offerings, Qmulos leverages tools such as the Splunk Machine Learning Toolkit (MLTK) app for advanced analytics and Splunk UI Toolkit for a modern UX experience. Q-Compliance App: How Qmulos Revolutionized Cybersecurity with Splunk Q-Compliance is Qmulos’s largest Splunk premium application, offering near real-time visibility into device compliance and security posture. It’s used by ISSOs, CISOs, Sec Ops, assessors and anyone else monitoring and reporting on IT infrastructure. It utilizes Splunk to collect data across many different categories such as network, firewall, account management, configuration management, and others that are required to be reported against as part of operating within the government and commercial space. Built by a team experienced in large-scale cybersecurity solutions, Q-Compliance leverages Splunk to deliver continuous monitoring without the bottlenecks of traditional SQL databases. This enables efficient audit preparation and enterprise-wide reporting, enhancing security operations and team productivity. Enhancing Development with Generative AI and Splunk Tools The team has recently realized significant productivity gains by using generative AI to research approaches and prototype new features. Maintaining tight feedback loops is critical for productive development, so they routinely use various “soft reset” commands available in Splunk – such as “_bump” and the /debug/refresh pages – which allow engineers to quickly see the results of code changes without requiring a full restart. Similarly, the Splunk Add-on for Visual Studio Code simplifies the development and debugging of custom Python endpoints, further streamlining the workflow. From Martial Arts to Masterpieces: Qmulos’s Team Got All the Moves (and the Games!) Qmulos is fortunate to have an uncharacteristically talented team. From award winning competitive martial artists, musicians that perform in and lead professional ensembles, to people who have appeared on television as actors. For fun, this amazing team is interested in sports and gaming (card games, board games, and video games).   Want you or your team to be our next Developer Spotlight? Let us know by filling out this form! ... View more

Watch On Demand. This thread is for the Community Office Hours session on Splunk 10.0: Your Guide to a Smooth Upgrade Journey on Thurs, Oct 02, 2025 at 1pm PT / 4pm ET.   Join us for a first look at the next evolution of Splunk Enterprise and Splunk Cloud Platform, Splunk 10, featuring powerful new capabilities to enhance data security, simplify operations, and ensure compliance readiness. This interactive Office Hour will not only highlight key updates designed to future-proof your Splunk environment but also provide a space to address your upgrade readiness questions in real time, with Splunk experts on hand to assist.   What can I ask in this AMA about the next Splunk upgrade? What is included in Splunk 10? What are the key innovations in Splunk 10 that customers should know about? What is the benefit of upgrading to Splunk 10? How can I upgrade to Splunk 10 and what is inclusive of upgrade readiness? How can I use the Splunk Health Assistant Add-on? (address EOL Upgrade Readiness App) SCP vs Splunk Enterprise Upgrade Readiness What are the breaking changes customers need to be aware of and action on?   Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (request access here).   Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with hands-on experience in Cloud, Security, and IT Operations. Starting his career in web development, he moved into Platform Engineering and Public Cloud infrastructure, earning the nickname “The Splunk Guy.” His SRE roles deepened his understanding of enterprise systems, which he now leverages in app development. Since creating Splunk apps locally in 2013, William released his first public app, AWS SQS Monitoring, in 2017, refining his expertise in Splunk app design. He has since published numerous apps on Splunkbase, many inspired by personal projects and real-world challenges.  Behind the Build: A Dev’s Story from Curiosity to Splunk .conf After his 2017 Splunkbase release, William discovered that building an app for public use required a new level of design, documentation, and portability. Many of his projects started as personal experiments, but sharing them with the Community has been highly rewarding. He has also delivered a number of .conf talks and workshops on app development, focusing on getting started, tools and techniques, and his passion for  CI/CD. Splunking Since 2013: From Pandemic Response to Cloud Powerhouse In 2020, William was tasked with building a monitoring service for the UK’s Covid vaccination and Test Tracking initiatives using IT Service Intelligence (ITSI). What began as a single-use case quickly evolved into a major project, with teams across the country utilizing the monitoring and sending logs in every format imaginable. This deepened his understanding of Splunk’s capabilities. Since then, he has consulted for UK companies, focusing on Splunk Cloud, On-Prem to Cloud migrations (including ITSI and Enterprise Security), and elements of the Splunk Observability Suite.  Deploy Smarter, Not Harder: Inside the Automated Deployment Helper for Splunk Cloud The app addresses CICD challenges by automating Splunk deployments using on-demand or scheduled authentication tokens. It supports Github.com, GitLab.com, GitLab Hosted pipelines, and AWS Secrets Manager. By generating short-lived, task-specific tokens, it enhances security, minimizes unauthorized risks, ensures token accountability, and enforces least privilege. This solution supports DevOps and CI/CD practices, reserving admin credentials for emergencies while delegating tasks to non-admin staff via role-specific tokens.       Behind the App: Simplifying Splunk Cloud Workflows with Secure Integration Splunk's REST APIs and cloud platform facilitate CI/CD integration, but managing secrets and tokens can be challenging for enterprises with strict security needs. To address this, the app was developed to generate short-lived, scoped tokens just-in-time, streamlining workflows, enhancing security, and enabling audit trails. Initially designed to export Splunk Cloud app contents into Git for audit and version control, the app evolved to support a two-way sync between Git and Splunk Cloud, supporting use cases like managing Splunk Cloud via the Admin Config Service, performing backups, and deploying Splunk ES consistently using tools like GitLab CI and GitHub Actions. Splunk App Development Like a Pro: Tools That Make It Easy For Splunk app development, the Universal Configuration Console (UCC) Framework is recommended for simplifying modular input apps that pull data from API endpoints. Complementing UCC, the Pytest Splunk Addon provides automated test coverage, offering reassurance for both Splunkbase apps and internal apps, ensuring compatibility with Splunk version upgrades or app changes. Additionally, the Splunk UI testing framework automates UI configuration workflows just as a real user would, enabling the application of DevOps best practices, such as Test-Driven Development, to Splunk app projects. The Splunk community is beginning to embrace these practices, and broader adoption is encouraged. For those new to Splunk app development, sessions like "Splunk App Building 101: Learn, Create and Navigate the Ecosystem" provide excellent starting points with workshops and downloadable guides. Experimentation and community support are key to success. Tech Projects and Tiny Hands: A Day in Will’s Life Would you believe it - William often finds himself working on more Splunk projects in his spare time! It’s a bit of a busman’s holiday. Joking aside, he has a young family (three girls!) who keep him busy and make it hard to tackle the backlog of personal projects. Lately, he’s found himself spending more time on creative endeavors around the house: perfecting sourdough (but it never lasts until the next day), gardening, and crafting (and being drawn on!) with the little ones. Want to be our next Developer Spotlight? Let us know by filling out this form! ... View more

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve listened closely to customer feedback, customers can now filter and browse apps based on author type—Splunk, Cisco, Partners, and Community. This simple yet powerful update introduces clearer trust signals and helps accelerate the path from search to solution. This update is more than just a new filter—it's the first step toward a more nuanced and effective approach to app discovery. By laying the groundwork for differentiated quality tiers and deeper engagement, we're creating a path toward a future where customers can confidently navigate offerings that best fit their unique needs. Apps marked as Built by Splunk or Built by Cisco are built and supported by Splunk and Cisco, respectively.  Apps marked as Built by Partners are built by official Splunk Partnerverse Build motion partners. If you’d like to learn more about being a Splunk Partner reach out to [email protected]. Community apps are the bulk of Splunkbase apps. It’s where Splunkbase began - admins building apps for other admins. This is a vital part of our marketplace that is now highlighted in a place of its own!  Our goal is simple: make it easier for customers to find exactly what they’re looking for, without limiting the variety of options available. This release balances structure and flexibility—offering powerful tools to narrow down choices while still embracing the diversity that makes our ecosystem thrive. In today’s digital landscape, application marketplaces have become essential for staying competitive. They streamline operations, improve efficiency, enable innovation, and deliver significant business value. For vendors, they enhance customer retention and open new channels for differentiation. The Critical Role of Application Marketplaces, a report by Futurum Research in collaboration with Splunk, explores how organizations are using platforms like Splunkbase, which features matter most to users, and how these ecosystems are adapting to today’s evolving IT and security landscape. As outlined in the Futurum Research report: “Looking across the application marketplaces companies utilize, several factors that influence their use of a marketplace stand out.” Application marketplaces have become mission-critical in the race to stay digitally competitive. What’s emerging on Splunkbase is only the beginning—stay tuned for what’s next. ... View more

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building new solutions, refining your existing apps, or just getting started, we’ve got a wealth of updates, insights, and opportunities for you to grow your skills and get more from the Splunk Platform. Splunk Developer Program + Splunk Build-a-thon  The Splunk Developer Program is launching in beta—a new *free* program designed to provide our developer community with the tools and resources needed to build high-quality apps all from a centralized hub. Check it out / sign up at preview.dev.splunk.com We’re celebrating this launch with an exciting hackathon! This is your chance to showcase your skills, explore Splunk’s developer capabilities, and compete for amazing prizes including .conf passes, Splunk EDU credits, and Cisco Store gift cards. Register Now! App Dev Community Office Hours Our most recent Community Office Hours session focused on OpenSSL3 and other upcoming changes to the Splunk Platform. Experts Tedd Hellmann and Michelle Moreira provided guidance on how to get your environment ready, while answering live audience questions and sharing actionable tips. If you missed it, no worries—you can watch it On Demand. Tech Talk: Holistic Visibility and Effective Alerting Across IT and OT Assets   On April 21st, we hosted a Tech Talk with security experts from Tenable to explore how combining Tenable and Splunk helps organizations achieve holistic visibility and effective alerting across both IT and OT infrastructures. It’s a must-watch for anyone focused on proactive cybersecurity. Watch it On Demand. SPL2 Hands-On Workshop Series Our SPL2 workshop series is here to help you unlock the full potential of the Splunk platform. These sessions walk you through getting started with Edge Processor, Ingest Processor, and utilizing SPL2 for app development. Perfect for developers ready to level up their Splunk skills. Catch the workshops On Demand. Developer Spotlight Series We’re excited to continue our Developer Spotlight blog series, where we feature standout developers from across our Splunk Community: Cameron Schmidt: A veteran Splunk app developer with over a decade of experience, Cameron has contributed dozens of apps to Splunkbase. Read more. Brett Adams: A SplunkTrust member and consultant, Brett’s innovative development work and community leadership have made him a key voice in the ecosystem. Read more. Preparing for OpenSSL3 and Platform Changes The next Splunk Platform release brings important security and compliance enhancements, including the transition to OpenSSL3. It’s vital to prepare your environment and apps now. We’ve compiled helpful resources to guide you: Preparing your Splunk Environment for OpensSSL3 Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the Next Splunk Platform Release Preparing to upgrade from 9.x to the upcoming release of Splunk Enterprise and Splunk Cloud Platform Splunkbase Year in Review 2024 2024 was a year of innovation and progress for Splunkbase and the App Dev Community. From enhanced tools and developer resources to new app ecosystem features, we’ve laid a strong foundation for an even bigger 2025. Check out the Year in Review. Join the Conversation and be part of the Splunk App Dev Community Connect with the Community on the #appdev Slack channel by clicking on this link, and if you are not part of our Slack community yet, get added here! ... View more

Reflecting on 2024, it’s clear that innovation and collaboration have defined the journey for Splunk developers, partners, and customers. From transformative app integrations to powerful AI enhancements and a thriving developer community, this year has been packed with momentum—and we’re just getting started. With the infographic linked below, let’s walk through the impactful ways the Splunk community came together to solve challenges, share knowledge, and push the boundaries of what’s possible! Hear from our customers and partners In 2024, we saw a number of partners and customers leverage Splunkbase apps to drive digital transformation. Here are a few standout examples: The following case studies showcase how Splunk Partners create winning joint solutions:   Splunk & Recorded Future Integration Gaining Digital Resilience with Recorded Future and Splunk. This collaboration tackles data overload, compliance challenges, and SOC bandwidth issues by integrating advanced threat intelligence and automation. Read more Mastering Threat Hunting. This insightful Tech Talk with Recorded FDuture dives into the world of threat hunting and explores the key differences between indicator-based and behavior-based approaches. Read more Infoblox App for Splunk Enhance Security & Network Visibility with Infoblox. Infoblox, a Splunk partner since 2011, developed an app to empower SOC analysts with advanced threat detection and response, boosting security efficiency. Read more   Splunk AI Assistant for SPL app With the launch of Splunk AI Assistant for SPL App, we offer bi-directional translation between natural language (NL) and Splunk Search Processing Language (SPL) to help Splunk users save time.   Developer Spotlight Closing out the year, we launched a Developer Spotlight blog series, where we feature some awesome Splunk developers from across our Community while showcasing their work. Check out the first spotlight on Paul Stout and his work behind the Duck Yeah! App. Also, if you are interested in being our next Spotlight, let us know by filling this form.    Apply to DAC 2.0  Builder Bar Returns – Revitalized with a renewed focus on the Developer Track at .conf24, we were honored to host and engage with 700+ Splunk practitioners. App Ecosystem Growth – Over the past year, Splunk has expanded its developer outreach and education, strengthening its community. A variety of resources – blogs, videos, tech talks, and courses – have helped developers grow the ecosystem. Blogs and videos shared best practices, while expert-led Tech Talks and courses provided deep insights and hands-on learning. These initiatives have empowered developers with the latest tools and knowledge to drive innovation. What’s Coming in 2025 Updated Splunkbase App Listing Experience featuring ability to create app listing drafts, view AppInspect results immediately, and conduct more administrative tasks like changing the app owner.  Developer Program Launch + Hackathon: This program empowers developers with tools, resources, and support to build innovative apps, enhance data insights, and grow within the Splunk ecosystem. Register for the Hackathon here .conf25: Thank you to everyone who participated in the call for papers process. We are actively working through content and event planning for an even better experience for our builders. Splunk .conf25 is heading to Boston this year, register now!  As we wrap up 2024, we want to thank our incredible Splunkbase community for their passion, innovation, and dedication. Your contributions continue to make Splunk a powerful platform for data-driven insights, security, and operational excellence. 2025 promises to be an even more exciting year with enhanced developer experiences, new features, and a stronger focus on AI and security. Stay engaged, keep building, and let’s shape the future of Splunkbase together! ... View more