Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings Splunk support cases into Cisco’s support ecosystem, laying out the foundation for future improvements, while maintaining the support experience you leverage today. In this community post, we have provided answers to key questions about what this migration means for you and why it is being implemented. Table of Contents Overview What does this mean for you? How do I Access Splunk and Cisco Services? How do I open a support case? What happens to my open and past cases? Re-opening a Closed Case What happens after the transition? Managing your cases What can Cisco AI Assistant for Support help me do? Case visibility Frequently asked questions Overview  At Cisco, we are committed to delivering a consistent and excellent support experience across all our products. Starting October 4th, Splunk Support cases will move to Cisco’s support platform. There is no action you need to take at this time. This change happens behind the scenes, so you can continue to access support as you do today. If you have an existing case while we transition, you will receive an email with a new case number What does this mean for you? The way you submit a Splunk support case is not changing. Your cases will continue to be handled by the same dedicated Splunk technical support engineers. There are also no changes to your Splunk dashboards or existing support links as part of this transition. Continue to use the Splunk Support Portal to: Open a support case Review your existing cases Add updates and attachments Work with Splunk technical support Behind the scenes, Splunk technical support cases will be managed through Cisco’s support environment. This enables Splunk support to benefit from Cisco’s technical support capabilities, automation, and AI-assisted support tools. Splunk Support portal       Support Channel  Current Process  After October 4 Phone  Call support to open a case  Same phone numbers. Find your regional number on https://www.splunk.com/en_us/about-splunk/contact-us.html  Splunk Support portal Go to https://login.splunk.com/ to open a support case. The process remains the same; go to https://login.splunk.com/ to open a support case. AI bot for Support cases No similar process at this moment.  For a self-service experience on case inquiries and basic transactions.   How do I Access Splunk and Cisco Services? Splunk customers can continue to log into the Splunk Support Portal with your existing Splunk credentials. As part of the migration, you can also use your Splunk credentials to log into Cisco services like Cisco AI Assistant for Support If you are an existing Cisco Customer with existing Cisco log in credentials, you will need to continue to use those to access Cisco services. How do I open a support case? Continue to open support cases through the Splunk Support Portal using your existing Splunk account and process. The following support requirements remain in place: You must have an active entitlement to open a support case. If your entitlement expires, you will no longer be able to create new support cases. No Cisco.com account or separate Cisco support login is required to submit a Splunk support case through the Splunk Support Portal. Opening a support case   What happens to my open and past cases? All open Splunk Support cases, along with up to one year of closed cases, will be migrated to Cisco’s support environment. If you are the owner or a viewer of a migrated case, you will receive an email containing: Your original Splunk Support case number Your new Cisco Support case number Please use the new Cisco Support case number in all future communications with your Support Engineer. The original case number will no longer be recognized by Cisco Support for Splunk, or the systems used to manage case communications. Re-opening a Closed Case If you need to re-open a closed case after the migration go-live, you must do so through the Splunk support portal Post-migration, it will no longer be possible to re-open a Support case by simply replying to an email, as was previously done before October 4. Please note: Closed cases can only be re-opened within 14 days of closure. After 14 days, you will need to open a new support case. Re-opening a closed case     What happens after the transition? You will continue opening cases through the Splunk Support Portal and using your existing Splunk account and support process as normal. Your Splunk technical support cases will be managed within Cisco’s support environment, but same dedicated Splunk technical support engineers will continue to assist you. Existing Splunk Documentation, Learning Center, Knowledge Base, and dashboard experiences remain unchanged. Cisco AI Assistant for Support capabilities will be available for all open Splunk Support cases. Access it here Cisco AI Assistant for Support Managing your cases You can continue managing your support cases through the Splunk Support Portal. Available case-management capabilities include: Searching for cases Reviewing open and closed cases Checking case status Updating case details Adding information or comments Uploading attachments Requesting case closure Use Cisco AI Assistant for Support with your open Splunk Support case   What can Cisco AI Assistant for Support help me do? Cisco AI Assistant for Support offers customers and partners a self-service experience for common case and bug inquiries and basic transactions. It even can connect customers with case owners, managers and Cisco Support for Splunk duty managers. Cisco AI Assistant for Support   The Self-Service Experience in the Cisco AI Assistant for Support provides case engagements to get things done quicker without waiting in queue: Get status on a case or bug Update cases, Upload files, and request an update (GenAI based real-time summary) Subscribe to case summary updates, case severity, status changes, Proactive Support case Alerts Connect to an engineer via Virtual Spaces, Virtual Meeting or Phone Callback Initiate to request a new engineer, Schedule dispatch, Raise severity, Reduce severity, Escalate case, Close case, Add Contract Be proactive by using Proactive Support case Alerts, Bug Applicability Checks & IOS XE SW Hardening Assessments   The Benefits of using Cisco AI Assistant for Support are: Easy to access Easy to use Seamlessly connect to an Engineer No need to call into support For a full guide on the Cisco AI Assistant for Support please visit Cisco AI Assistant for Support At-A-Glance. Case visibility Opening cases through the Splunk Support Portal provides the most consistent case visibility and support experience. Today, additional viewers must be added manually to a case. After the migration to Cisco’s support environment, users associated with the same entitlement will automatically be able to view new cases. Additional viewers can still be added manually when needed. The following considerations apply: Migrated historical cases can only be viewed by the original case creator, unless the viewer is added manually. Cases with unmatched user, organization, or entitlement information may have limited visibility. Frequently asked questions Is the way I open a Splunk support case changing? No. Continue opening cases through the Splunk Support Portal using your existing Splunk account and process. Do I need a Cisco.com account to open a Splunk support case? No. A Cisco.com account is not required to submit a Splunk support case through the Splunk Support Portal. Is my Splunk login changing? No. Continue using your existing Splunk credentials. Are the Splunk dashboard or support links changing? No. Your existing Splunk dashboard and support-link experience remain unchanged. Will I still work with Splunk technical support engineers? Yes. The same dedicated Splunk technical support engineers will continue to assist you. Will my open cases be migrated? Yes. All open cases will be migrated to Cisco’s support environment. Will closed cases be migrated? Up to one year of closed cases will be migrated. How do I identify a migrated case? On the Splunk Portal, migrated cases will include their original Splunk support case number in the case title alongside the new Cisco Support for Splunk case number. Does Cisco AI Assistant replace my support engineer? No. Cisco AI Assistant is an additional self-service tool. Your Splunk technical support engineer will continue to investigate and manage your support case. Can Cisco AI Assistant resolve my technical issue? Cisco AI Assistant can help you access case information, manage supported case actions, and find relevant technical resources. Complex troubleshooting and resolution continue to be handled by your Cisco Support for Splunk technical support engineer.   ... View more

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed with learning. But when the breakout rooms clear, it’s time to step away, grab a drink, and connect with the community. Whether you’re looking to break the ice on day one, catch up with peers in the Pavilion, or celebrate at our biggest night of the week, here is your guide to unwinding at .conf26. Welcome Reception When: Monday, September 14 | 3:30 PM – 4:30 PM Where: Pavilion Kick off your .conf26 experience right as the doors open. Grab a drink, mingle with your peers, explore the Pavilion floor, and get hyped before heading over to the official Welcome Keynote. Happy Hour When: Tuesday, September 15 | 5:00 PM – 6:00 PM Where: Pavilion After a full day of deep-dive sessions, take an hour to decompress. Grab a beverage, connect with fellow practitioners, trade architecture tips, and explore the interactive demos and activations across the Pavilion floor. Search Party! When: Wednesday, September 16 | 7:00 PM – 10:00 PM Where: Colorado Convention Center Who: We all know everyone is waiting to find out. We hope we get to share the news soon! 🙂 Our signature evening celebration is back! Once the day's learning wraps up, go beyond the frontier of .conf26 for an unforgettable night filled with entertainment, food, interactive experiences, and surprises around every corner. It’s the ultimate way to celebrate the Splunk community.  Make the Most of Your Evenings Conferences are only half about the slides. The rest is about the connections you make along the way. Make sure to star these events in your .conf mobile app schedule so you don't miss out!   ... View more

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust member, @ITWhisperer cooking up Puzzles to test your pattern-matching prowess. Whether you’re a regex/SPL wizard who solves these in your sleep, someone who looked at a puzzle once and thought “nope, not today,” simply wondered "How on earth would I attempt to do that?" or you’re just hearing about them for the first time, we want to hear from you! We are running a quick, 3-minute community survey to understand how we can make these games more fun, accessible, and rewarding for everyone. 🎯 Why We Need Your Feedback We want these puzzles to be a fun part of your community experience, not an intimidating chore. By taking this quick survey, you’ll help us answer key questions like: Is the difficulty right? Should we introduce tiered levels (Beginner vs. Advanced)? Are time constraints an issue? Would mid-week hints or cheat sheets help you across the finish line? What content do you want to see? How can we make these puzzles directly applicable to your real-world Splunk workflows? 🎁 What’s In It For You? We know your time is valuable, so we’re backing this feedback loop with real rewards! Winner Spotlight & Prizes: Moving forward, puzzle winners won't just get bragging rights, we’re introducing gift card prizes for solvers, along with a Community Spotlight feature where winners can publish a write-up detailing their exact workflow and solution!  ⏱️ Take the 3-Minute Survey The survey uses dynamic logic, so whether you’ve solved 10 puzzles or zero, you’ll only see questions relevant to you. 👉 Take the Splunk Puzzle Survey  What’s Next? Once we gather the insights, we’ll share a summary of what we learned and how we’re updating the puzzle format for the next round. Thank you for helping us make the Splunk Community a more engaging place to learn and build together. Drop any immediate thoughts in the comments below, and happy puzzle solving! ... View more

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also about finding the right experts, tools, and networks to accelerate your daily success. Whether you’re looking to troubleshoot a complex architecture challenge, chart your path toward a new Splunk Certification, or unlock the full value of your cloud deployment, the Acceleration Station is your ultimate home base. Stop by to recharge your skills, connect face-to-face with top community legends, and complete interactive challenges to walk away with exclusive, limited-edition .conf26 pins and swag. Here is your inside look at what to expect across our Community, Customer Experience, and Education hubs!  Community  Whether you’re looking to troubleshoot a tricky architecture question or expand your professional network, the Splunk Community is your ultimate hub for real-time support and connection. Drop by the Community booth in the Acceleration Zone to explore all the ways you can plug in. Dive into our Answers forums and community blogs for the latest product announcements, hop into Slack for real-time peer chats, or discover a local User Group to keep the momentum going with in-person connections back home.  You’ll also have the chance to meet face-to-face with our SplunkTrust members, some of the most knowledgeable practitioners in the ecosystem, who will be on-site to share their battle-tested expertise. And when you need a break between sessions, our space has you covered with giant lawn games and plenty of comfortable seating to relax, recharge, and connect with fellow attendees.  Customer Experience  Ever wonder what different customer resources are available to help you on your journey with Splunk? Do you know where to go to find these and how they can help you whether you are new to Splunk or a seasoned veteran user? We have the answers for you in the Customer Experience area of the Acceleration Station. Take a quick journey with experts for adopting platform, security and observability applications, understanding the total value of using the Splunk Cloud Platform, as well as learn how resources such as Professional Services, Lantern and the Insights Suite for Splunk can turn you into a power user and organizational hero. Oh, and while you are learning all about these resources, you can collect exclusive Splunk stickers that will be your ticket to earning a new Splunk Customer Experience pin to display on your lanyard. This pin is part of an exclusive series available only at the Acceleration Station. Earn all three pins and walk away with a new Splunk T-shirt to add to your collection.   Education & Certification: Refuel your skills  Think you've mastered Splunk? Or maybe you’re just getting started? Either way, make the Acceleration Station your first stop at .conf26. This is your chance to get familiar with all that Splunk Education has to offer through bite-sized eLearning and hands-on labs. Through interactive challenges, you can learn more about Splunk Certifications, Splunk Community, Lantern, Authorized Learning Partners (ALPs), Learn with Cisco, and the Splunk Academic Alliance program. Complete a variety of learning challenges or a lab experience to unlock the next milestone on your journey, collect an exclusive pin, and earn your way toward a coveted Splunk t-shirt. Along the way, you'll discover practical resources, career-building opportunities, and expert guidance that can help you get more value from Splunk long after the conference ends. Bring your thirst for knowledge, refuel your skills at our booth, and leave with some great Splunk swag in your bag.    Ready to level up your skills, collect exclusive pins, and grab your limited-edition .conf26 t-shirt? Make the Acceleration Station your first stop on the show floor in Denver. Connect with experts, test your knowledge, and take your Splunk journey further. ⚡ Lock in your pass for Splunk .conf26 today! ... View more

There’s no shortage of incredible content lined up for .conf26 in Denver, from deep-dive technical sessions and interactive gaming lounges to hands-on workshops. But ask any veteran attendee, and they’ll tell you that the true value of the week comes down to how you navigate the experience. To help you get ready, we gathered some of the best advice directly from past attendees and SplunkTrust members. Here is how to prep like a pro. 1. Ditch the Device (And Travel Light) It’s easy to feel glued to your laptop or phone during sessions, but device distractions can keep you from truly absorbing what's happening in the room. "Travel with pen and paper. Free yourself from device distraction and note which talks and areas to follow up on." — Trex Pro Tip: Use an analog notebook to jot down quick takeaways, speaker names, or booth ideas. You can always dig into the code or documentation when you get back to your hotel room. 2. Prioritize Non-Recorded Sessions & Flexible Calendars While it’s tempting to pack every single minute of your calendar with back-to-back sessions, don't over-schedule yourself. "Prioritize attending non-recorded sessions over recorded ones." — Rich Galloway Many interactive workshops and hands-on labs are not recorded, making them high-priority targets for your live schedule. However, give yourself permission to step back if you start feeling conference burnout. "Just because you sign up, if you are overwhelmed, you don't have to attend a talk/workshop... If it's something like a workshop where seats are limited, please go into the app and remove yourself though, so they can admit standby folks." — Brandon Sternfield 3. Step Outside Your Comfort Zone (And Commune!) The hallway track is often where the most valuable technical breakthroughs happen. Don't spend the whole week surrounded only by the people you traveled with! "Don’t sit for meals with people you know (especially work colleagues) - share a table with people you don’t know." — Chris Barrett Building a real network means making time for organic human connections across the show floor. "It's tempting to fill every slot in your calendar with something, but don't do that. Make time for the community. I learned a lot from talking to people, talking to vendors at the pavilion, talking to the SplunkTrust at the community booth, crashing different tables at the meals, talking to people on break/lunch during Splunk University. It's all learning." — efavreau 4. Hydrate & Hydrate Some More (Denver Altitude Edition) Denver sits at 5,280 feet above sea level. If you're coming from near sea level, the high altitude and dry climate can catch you off guard fast if you aren't prepared. "Stay hydrated! This is a personal one for those that know my own attendance habits." — Trex "Folks not acclimated to high altitudes may experience altitude/mountain sickness. Speaking with your healthcare provider before traveling, preparing for the new environment, and arriving a day or two early may help." — tscroggins Denver Altitude Essentials: Drink water before you feel thirsty, pack lip balm/moisturizer, go easy on the alcohol during evening socials, and give your body time to adjust! Want More .conf26 Insider Guides? From hands-on gaming zone breakdowns to curated session guides by track, we’re highlighting the best of the show floor leading up to Denver. Explore all of our .conf26 spotlight articles here. Lock In Your Pass Today Ready to take these pro tips and put them into practice on the show floor? Don't wait for registration rates to increase or popular hands-on workshops to cap out. Register for Splunk .conf26 in Denver today! ... View more

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The Splunk Dashboard Contest. We were genuinely impressed by the creativity, technical expertise, and variety of dashboards submitted. From security operations and observability to executive reporting and entirely unique use cases, it was exciting to see how each participant approached solving real-world challenges with Splunk Dashboard Studio. A special thank you also goes out to our panel of Honorary SplunkTrust judges, who dedicated their time to carefully review every submission. With such a strong field of entries, selecting the winners was no easy task. Without further ado, let's congratulate this year's winners   🥇 First Place AirspaceWatch — Live Radar Winner: @livehybrid  AirspaceWatch — Live Radar impressed the judging panel with its creative concept, polished execution, and effective use of custom visualizations. Judges also praised the thoughtful integration of supporting resources and the dashboard's overall user experience. Congratulations on taking home a complimentary pass to Splunk .conf26! 🥈 Second Place Edge Processing Ops Center Winner: @ArbiterOfData Edge Processing Ops Center stood out for its ability to present a large amount of operational data in a concise and meaningful way. Its strong technical implementation and comprehensive operational view earned it a well-deserved second-place finish. Congratulations on winning a complimentary pass to Splunk .conf26! 🥉 Third Place AWS Security Topology Winner: @youngso  AWS Security Topology showcased a strong security-focused design with an emphasis on modern visualization techniques. Judges appreciated its practical approach to helping users understand complex security relationships and events. Congratulations on winning a complimentary pass to Splunk .conf26! Fourth Place Executive Dashboard Winner: @Yoshi-Koizumi  Executive Dashboard earned recognition for its polished visual presentation and approachable user experience. Its creative application demonstrated how dashboards can make complex information accessible to a broader audience. Congratulations on winning a $400 Cisco Merchandise Store gift card! Fifth Place Claude Usage Winner: @sispehar  Claude Usage tackled one of today's most relevant topics by visualizing AI usage and trends. Judges highlighted its timely concept and appreciated the innovative approach to presenting AI-related metrics. Congratulations on winning a $400 Cisco Merchandise Store gift card! Sixth Place Agentic Ops Control Center Winner: @hkchun18  Agentic Ops Control Center showcased a modern operations-focused use case with strong practical value. Its exploration of emerging AI operations workflows made it one of the contest's more forward-looking submissions. Congratulations on winning a $400 Cisco Merchandise Store gift card! Seventh Place Teen Social Media Impact Winner: @blkwomenread  Teen Social Media Impact demonstrated how Splunk dashboards can be applied beyond traditional IT and security use cases. Its unique subject matter and thoughtful visualization approach helped it stand out among this year's entries. Congratulations on winning a $400 Cisco Merchandise Store gift card! Thank You Congratulations again to all of our winners, and thank you to everyone who participated in this year's contest. Seeing the creativity, technical skill, and passion our community brings to Dashboard Studio made this contest a huge success, and we hope it inspired others to push the boundaries of what's possible with Splunk dashboards. We're also exploring the opportunity to feature our top three submissions in future Community blog posts, where the creators can take a deeper dive into the inspiration, design decisions, and technical implementation behind their dashboards.  Thanks again for being part of the Splunk Community, and we look forward to seeing what you build next!     ... View more

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already have your ticket and need a little help getting approval from your boss, we've got you covered.  [Hopefully], your manager loves you, but they also love budgets. And while you know that heading to Denver this September means unlocking a year’s worth of Splunk training, certs, and hands-on masterclasses in just four days, pitching it to the higher-ups can sometimes feel like trying to parse unindexed log data. We’ve got the official, approval letter ready to go. All you have to do is copy, paste, fill in the blanks, and hit send. Pro-Tip before you send: Want to make it an absolute "yes"? Customize those bullet points! If your team is sweating over a messy dashboard environment, tell them you're hitting the Data Visualization Zone. If you're building next-gen apps, mention the Builder Bar. Show them exactly how you're bringing the solutions home. Grab the template below and go get that green light! 📋 The Copy-and-Paste Approval Template To: From:  Re: Approval to attend Splunk .conf26 Hi [Name], I hope to get your approval to attend Splunk University, September 12–14, and .conf26, September 14–17, 2026, at the Colorado Convention Center in Denver. I’m excited by this opportunity to get a year’s worth of training and education in a few days. It'll give me insights and solutions to share with our team so that we can fully grasp the capabilities of our current Splunk products and come away with new strategies for the future. This year, .conf26 is offering more technical sessions, additional networking opportunities, and hands-on help with the tools that I use daily in my role. I’m looking forward to: Taking heavily discounted certification exams Learning how to get the most out of our Splunk investments Gaining complete visibility across all our infrastructure Seeing new products and add-ons in person and being able to learn about them directly from Splunk experts Breakfast and lunch are included during the conference, which lowers the cost to the company. If you want to see more information about .conf26, including pricing packages, visit the website. I estimate our investment to be around XYZ. I’m also happy to answer any questions for you! I’d be so grateful for the opportunity to further my career. Thank you for considering, and I look forward to hearing if attendance is approved. Warmly, [Your name]   🔒 Lock In Your Spot Once your manager signs off, don't wait for prices to increase or high-demand technical sessions to cap out. Send the email today, grab your approval, and then click the link below to join us in Denver! Already have the go-ahead to attend conf26? Register now!    Explore all of our .conf26 spotlight articles here ... View more

  Lock in Your Spot: Registration Open for .conf26 in Denver Hello Splunkers, I have exciting news! Your favorite multi-day conference of the year is now open for registration! Key Conference Details Dates: September 14-17, 2026 Location: Colorado Convention Center in Denver, Colorado Urgent Deadline: Early bird tickets are available until June 22, 11:59 pm PT. Action Plan: How Do I Register? Register here! FYI: Early bird tickets are being sold until June 22, 11:59 pm PT. Logistics: Where Do I Stay? Check out the list of conference blocked hotels here: Splunk .conf26 Hotel List Experience: What Can I Expect? You can expect to have a lot of fun, network, and join in on technical sessions, interactive workshops, panel discussions, theater session and demos on the show floor.   Don't wait until prices go up, block off your dates from September 14-17, secure your hotel room, and register today to save with early bird pricing!   Explore all of our .conf26 spotlight articles here ... View more

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this year’s event is shaping up to be one of the biggest opportunities yet for Splunk customers, practitioners, and partners to learn, connect, and explore what’s next.  From hands-on demos and technical sessions to live product experiences and networking opportunities, Cisco Live brings together the people, tools, and ideas helping organizations move faster and work smarter with their data.  Whether you’re focused on security, observability, IT operations, networking, AI, or the Splunk Platform itself, there will be plenty to explore throughout the week.  Event Details  📍 Location  Mandalay Bay Convention Center  Las Vegas, Nevada  📅 Dates  May 31 – June 4, 2026  🎟️ Registration  Registration is now open for Cisco Live 2026 Las Vegas.  Additional event information and registration details can be found on the official Cisco Live website.  What Splunk Customers Can Expect  Cisco Live 2026 will feature a wide range of Splunk-focused learning opportunities and experiences throughout the event.  Here are just a few highlights attendees can expect:  Technical Sessions & Hands-On Learning  Explore sessions covering:  Splunk Platform & Data Management  Splunk Networking  Splunk Security  Splunk Observability & ITOps  You’ll also be able to browse the session catalog and build a personalized schedule around your areas of interest.  World of Solutions  The World of Solutions showcase will feature:  Live Splunk product demos  Interactive walkthroughs  Hands-on experiences  Capture-the-flag style activities like Splunk Arcade and KubeDoom  This is one of the best places to see Splunk technologies in action and talk directly with experts working across real-world use cases.  Ask the Experts  Our very own SplunkTrust experts will be on site to talk with you about your Splunk questions, no matter the size or difficulty. They can be found at the Meet the Engineer experience at the Splunk Cafe or at the Splunk Lounge (located on level 2).  Start Planning Your Week  Once registered, attendees can use the Cisco Live session catalog and scheduler to start planning their week and bookmarking the sessions most relevant to their role and interests.  Cisco Live 2026 is a great opportunity to learn new skills, connect with experts, and see how Cisco and Splunk technologies continue to evolve together across security, observability, networking, and AI.  We hope to see you in Las Vegas this May.    Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.    ... View more

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… this is a very specific search. 😄  Which usually means one thing...you’re in the middle of a BOTS challenge and hit a wall.   Alright, here’s the deal  Yeah, the answer exists. No, we’re not going to just hand it over.  Not because we’re trying to be difficult, but because that kind of defeats the whole point of BOTS.  The goal isn’t to collect answers. It’s to figure out how to find them.    The good news  If you’re searching for this, you’re probably not that far off.  You’ve likely already:  Found the right data  Narrowed down the moment something happened  Realized a USB device is involved  That’s like… 80% of the work. What’s left is just digging a little deeper.    A small nudge (no spoilers)  If you’re stuck, try this:  Go back to the time the device was inserted  Look at fields tied to external devices or file activity  USB keys are typically named something, and that name is usually stored or registered somewhere in Windows...  Don’t just scan...actually read the details  The answer isn’t hidden. It’s just easy to overlook.    What is BOTS?  Are you reading this and now you’re either confused or curious about what BOTS is and how to participate? We got you.  BOTS is a blue-team, jeopardy-style, capture-the-flag-esque (CTF) activity where participants leverage Splunk Security to answer a variety of questions about the type of real-world incidents that security analysts face regularly. We developed BOTS because we were tired of showing up at security conferences and finding the CTFs to be entirely red team-oriented. There are other blue team CTFs out there but few of them attempt to recreate the life of a security analyst facing an adversary at all stages of an attack.    Where can I play BOTS? Explore BOTS  for the first time, or jump back in here!   If you’re not subscribed, you’re probably missing something good. Fix that!  ... View more

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s event. But before we dive into everything coming next, we wanted to share a new resource now available in the Splunk Community. We’ve officially launched a dedicated Best of .conf experience within the Community to help you revisit some of the most valuable sessions from previous years. Just because .conf ends doesn’t mean the learning has to. Explore the Best of .conf You can now find the new Best of .conf pages under the top-level Learning navigation in the Community. To make exploring easier, sessions are organized into four practitioner-focused tracks: Observability Security Platform Admin Splunk Developer Within each track, sessions are also grouped by skill level: Novice, Intermediate, and Advanced; so whether you’re just getting started or deep into your Splunk journey, there’s something useful to explore. Each featured session includes: Direct links to presentation slides Session video recordings Session descriptions and speaker information Our goal with these pages is simple: make it easier to discover and revisit great .conf content long after the event wraps up. Whether you’re catching up on sessions you missed, revisiting a favorite talk, or looking for learning resources to sharpen your skills, we hope this becomes another helpful tool in your Splunk toolbox. Take a Look We’d love for you to explore the new pages and let us know what you think. Do you have feedback on the layout, session selection, or anything else you’d like to see added in the future? Drop your thoughts in the comments below. While we have you, registration for conf26 is now open. Will we see you there?  Best, Ryan Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.   ... View more

Hello Splunkers,  We’re excited to share two big upgrades coming to community.splunk.com today. These changes are all about making the community experience faster, more relevant, and uniquely yours.  🚀 Community Search, Powered by Splunk  We’ve given Community Search a massive boost by implementing Splunk’s own Federated Search.  What does that mean for you? Efficiency. Instead of hunting through different tabs, you can now filter your Community search results to include other vital sources like Docs, Lantern, and Splunk.com. Don't worry, you still have all the granular filters you love. You can still drill down into specific forums, blogs, and date ranges, or toggle to see only posts with an Accepted Solution.     ✨ Your Community, Your Way: Personalized Activity Feed  Ready for a more tailored experience? You can now customize your home page to show the content that actually matters to your role and interests.  The Benefit: If you’re an Observability Professional, you can set your feed to highlight the latest Observability conversations the moment you land on the home page. No more digging to find your signal.  How it works: While the "Personalization" toggle is now available on your home page by default, it needs your input to start working! Once you answer a few quick interest questions in your profile, your personalized feed will spring to life.  How Do I Set Up Personalization?  Getting started takes less than a minute:  Sign in to the Community.  Click your Profile Photo (top right) and select My Settings.  Go to the Personal Information tab (found on the second row).  Scroll to the Personalization Information section.  Select the topics and interests that matter to you.  Hit Save at the bottom of the page.  Note: You can update these interests at any time if your focus shifts!    How do I turn off/on the Personalized feed?  By default, once you answer the questions from the steps above, the personalization feature will be turned on by default. You can follow the instructions below to toggle it off.   Go to the Community Home Page.  Scroll down to the Community Activity section.  Toggle the “Turn on Personalization” off/on button.     Need to refer to these instructions again? Instructions can be found in the Welcome Center.    Share Your Thoughts!  We’d love to hear how these new features are working for you. Is the new search helping you find answers faster? Is your feed feeling more relevant?  Reply directly to this post.  Join the conversation in our Slack Community in the #community-feedback channel.  Happy Splunking!    ... View more

GovSummit 2026: What to Expect in Washington, D.C.  Splunk GovSummit brings together public sector technology leaders to share insights and best practices for addressing the evolving threat landscape, driving innovation, and delivering improved services and outcomes for residents.    Start the Day Connecting  The morning kicks off with registration and a networking breakfast, a critical window to meet peers before the technical sessions begin.  Keynotes and Direction  From 9 am to 12 pm, keynote sessions explore the high-level roadmap for government technology.  Hear how AI is helping organizations modernize their operations, save time, and gain efficiencies so they can concentrate on helping deliver citizen services and accomplish their missions. Join our unified public sector leadership — including Bill Rowan, VP of Sales at Splunk and Gary DePreta, SVP of Sales at Cisco — as they discuss the power of combining deep network intelligence with real-time analytics. You’ll learn how our integrated, AI-ready data foundation builds government resilience across complex, distributed environments.    Afternoon Breakouts: Practical Applications  After lunch, you can customize your experience by choosing sessions aligned with your specific technical focus area:  [1:45 – 2:30 pm] Focus: Infrastructure and Security  Securing Distributed Networks with Cisco Secure Access for Government  Leveraging Cloud and Data Fabric Architectures to Secure at Scale  Achieving End-to-End Visibility: ThousandEyes Solutions for Government Networks  Modernizing Security Operations: Structuring Cyber Data for Better Threat Detection and Response    [2:45 – 3:30 pm] Focus: AI and Modernization  AI-Driven Public Sector Defense and Fraud Prevention  Modernizing Government Networks: Simple, Secure, and Scalable Solutions with Meraki  Maintaining Data Resilience and Proactive Operations  Smarter Service Delivery: AI-Powered Automation for Federal Success  Close the Day with Peer Conversations  The reception from 3:30 – 4:30 pmgives you time to connect with fellow practitioners. Sometimes the most valuable takeaway isn’t just what you learned; it’s the relationship built with someone solving the same mission-critical problems.    Don’t Forget April 7  If you’re joining Splunk University or BOTS, you’ll get an additional day of immersive, hands-on learning. Together, April 7 and 8 deliver an experience of skill development and practical insight.  👉 Register now and join us in D.C.  ... View more

Cybersecurity at the Epicenter: Previewing RSA Conference 2026 in San Francisco The cybersecurity world is converging on the Moscone Center from March 23-26, 2026. In an industry marked by rapid change, RSAC 2026 serves as the global epicenter for discovering transformative solutions and engaging in the deep conversations that keep your organization one step ahead of the curve.   Why RSAC 2026 is a Must-Attend RSA Conference is where the cybersecurity community comes together to gain invaluable insights. This year's experience is built around three core pillars for professional growth: Enhance Your Expertise: Immerse yourself in dynamic sessions covering emerging threats and practical solutions. You can also earn Continuing Education (CE) credits through collaborations with industry associations. Expand Your Professional Connections: Engage with the brightest minds in the field through structured group discussions, casual conversations, and hands-on learning. Embrace Leading-Edge Innovation: Explore the Expo featuring over 600 vendors and discover emerging talent at the RSAC Early-Stage Expo. 2026 Theme: The Power of Community Since 1995, RSAC has selected a distinctive yearly theme. For 2026, the theme is the Power of Community, which focuses on the people, the heart of cybersecurity. At RSAC™ 2026, connections spark innovation. By joining forces and sharing knowledge, the community doesn't just face challenges—it rises above them.  Technical Deep Dive: Splunk at RSA Conference Splunk is thrilled to be part of the conversation at Expo Booth N-6144. We invite you to experience hands-on demonstrations showing how Splunk technologies accurately detect threats and automate response. Live Security Demos: Agentic SOC on a Data Fabric Foundation: See how Cisco Data Fabric unifies enterprise machine data for real-time, AI-powered threat detection. Detection Authoring and Tuning: Explore the end-to-end detection lifecycle to improve confidence and reduce mean-time-to-detect. SOC Workflow Automation and Orchestration: Discover how natural language prompts can rapidly generate and validate SOAR playbooks. Featured Keynote: Don't miss Splunk’s Mike Horn and Cisco’s Tom Gillis discussing how AI-driven solutions are transforming threat detection and incident response. Planning Your Trip: Passes & Rates Check out the Splunk landing page for discount codes and additional registration details.  ... View more

Get hands on at  at GovSummit 2026  For the first time ever, we’re hosting a Boss of the SOC (aka BOTS) competition and Splunk University at GovSummit. Join us on Tuesday, April 7, the day before the main program,  to experience these opportunities to pressure-test your skills through live-fire simulations and expert-led  training courses.  About BOTS  April 7, 1– 5 pm   BOTS is a capture-the-flag style competition where you step into the role of a SOC analyst and work through realistic security challenges. Using Splunk Search, Enterprise Security, and SOAR, you’ll investigate activity across data sources like:  Cloud Environments: AWS security logs and Microsoft Cloud (Office 365 and Azure)  Endpoint and OS: Windows Security and PowerShell, Linux, and Sysmon  Network Security: Wire data and CheckPoint NGFW  What to Expect  Expert guidance from Splunk security SMEs  Real-world skill assessment  Exposure to frameworks like MITRE ATT&CK® and the Lockheed Martin Kill Chain  A competitive edge (yes, there’s a winner)  👉 Learn more about BOTS and secure your spot.    About Splunk University: Enhancing SOC Operations  April 7, 9 am – 5 pm  This full-day, interactive course focuses on improving threat investigation, detection, and incident response using attack simulations.  Workshop Objectives  Participants will:  Identify gaps in detections  Refine investigative workflows  Test remediation strategies  Work through realistic incident response scenarios  Use tools like Atomic Red Team  Leverage Splunk Enterprise Security and SOAR  👉 Register for GovSummit and add BOTS or Splunk University to your agenda. ... View more

Hello Splunkers! We’re always looking for ways to make the Splunk Community a more intuitive place to hang out. Today, we’re excited to share some updates to our top-level navigation. We’ve moved a few things around and gave blogs and events their own dedicated spaces to make sure the content you need is always right where you expect it to be. Here’s a snapshot of what’s changing: 1. A New Home for Champions We’ve reorganized the "Be a Splunk Champion" section to better highlight the amazing people who power this community. Whether you're looking to join the SplunkTrust, become an MVP or lead a User Group, everything is now in one place: Welcome Center: Your starting line for the community basics Join Slack: Want to chat in real-time with members of the community? The Slack Community is waiting for you Splunk Champions: Direct access to SplunkTrust, MVP programs, User Group Leadership, and the Badges program. Splunk Love: The place to share success stories. Share a Tip: Your place to share any tip you want about Splunk.  2. Streamlined "Find Answers" We’ve trimmed down our high-level categories to help you jump straight into the technical forums that matter to you. The new structure focuses on your workflow: Splunk Administration: From Getting Data In (GDI) to Deployment Architecture. Using Splunk: Perfecting your Search, Dashboards, and Visualizations. Platform Products: Dedicated spaces for Enterprise, Cloud, Observability, and AppDynamics. Apps & Add-ons: Quick links to all app-related discussions. 3. [New] Dedicated Events Hub Events are the heartbeat of our community. We’ve given them their own top-level home so you never miss a beat: User Groups: Connect with local peers. Office Hours: Get direct help during live sessions. Tech Talks: Deep dives into the latest Splunk innovations. 4. [New] A Centralized Blog Feed Our blog content has grown so much that it earned its own spot in the main nav! Now it's easier than ever to stay updated on: Community News: Updates from the team and member spotlights. Product Announcements: The latest from the Splunk dev teams. Training & Certification: Vital info for your professional growth. 5. [New] The Learning Category While the content is familiar, the "Learning" tab makes it much simpler to find resources for leveling up your skills. This hosts our Learning Paths, Training & Certification, and the AppDynamics Knowledge Base in one convenient spot. Better Navigation, Better Connections While these changes might seem small, our goal is to make the "awesome" parts of this community more visible to everyone.  Not seeing the changes? If you are having trouble with the navigation not reflecting the changes I outlined here, clear the site cache and cookies. If that does not help, please allow a few days for all the changes to reflect as the platform always needs to update its cache.  Take a look around and let us know what you think in the comments below. See you in the forums! Cheers, Ryan  ... View more

Key Takeaways What: GovSummit 2026, Splunk’s complimentary public sector event. Register today!  When: Wednesday, April 8, 2026  Where: Marriott Marquis, Washington, D.C.  Why attend: To experience the future of government technology firsthand and get solutions for the industry’s most pressing challenges.    In the public sector, system downtime and security gaps aren’t just technical hurdles, they’re risking critical services. GovSummit is designed to give you the tools to maintain digital resilience in a world of siloed data, challenging workflows, and evolving threats.  Government and industry experts will share how their agencies are adapting, thriving, and building digital resilience to achieve success. Join us to network with fellow public sector professionals, learn the latest observability and cybersecurity trends, and see how other agencies are mobilizing to meet challenges — like maintaining the integrity of critical systems, safely adopting AI, and meeting strict baselines for compliance and risk.     Read the Top 5 Reasons to Attend blog by Bill Rowan, VP of Sales, to learn more about this can’t-miss opportunity!    Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.   ... View more

Hello Splunkers, The first Lightning Talks were a hit. So we’re running it back. Join us for the second edition of Splunk Community Champions Lightning Talks — a fast-paced virtual event featuring top tips, smart tricks, and real-world insights from our SplunkTrust and MVPs. This is practitioner-to-practitioner knowledge sharing at its best. And yes...we’re running it twice so our global community can join live. When? February 26, 2026 Option 1: 10am PT / 12pm CT / 1pm ET 👉 Register for Option 1 Option 2: 6pm PT / 8pm CT / 9pm ET 👉 Register for Option 2 Pick the time that works best for you. Same great content. Global-friendly schedule. What’s On the Agenda? Our Splunk Community Champions are bringing practical sessions you can apply immediately: Asset & Identity in Enterprise Security How to Find and Fix Overdemanding Searches in Your Splunk Environment Splunk Edge Processor 101 Edge/Ingest Processor Is Amazing (And Why You Should Use It) Navigating OT Data Challenges: Edge Hub + AI Integration Whether you’re focused on Security, Platform, Observability, or Edge — there’s something here for you. A Global, Community-Led Event This event is presented by members of the Splunk Champions Community — SplunkTrust and MVPs who are actively using Splunk every day. Sessions will be simu-live depending on speaker availability. When speakers are available, they’ll be live in chat. And if not? You can always follow up afterward in #splunk-community-events on Slack. Because the best part of these events isn’t just the content. It’s the conversation. What’s “Splunk Community HQ”? You may see this event listed under the Splunk Community HQ chapter. That’s simply our global “user group” that allows us to host virtual events for the entire Splunk User Group community. If you haven’t joined your local User Group yet, now’s a good time. Head to usergroups.splunk.com, search your city, and connect with practitioners near you. Why You Should Join Learn directly from SplunkTrust and MVPs Pick up practical techniques you can use immediately Connect with practitioners from around the world Be part of an active, global Splunk Community moment This is one of those “easy yes” events. Pick your time. Register. Show up curious. 👉 Register for Option 1  👉 Register for Option 2   Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.     ... View more