Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, networking, and community energy. For me personally, this was extra special. As someone who recently joined Splunk from the AppDynamics Community, it was my very first .conf. I finally got to meet so many of my coworkers face-to-face and connect with countless community members I’d only known online. It was an honor (and honestly, a lot of fun) to spend time at the Community Booth chatting with everyone who stopped by. But enough about me — let’s dive into some highlights! .conf-ersations 💬 This year we introduced .conf-ersations, an experimental new format for attendees to host their own roundtable discussions. Anyone could propose a topic, sit down at a table, and see who joined them. The results were as varied as they were inspiring — from deep dives into fantasy books to heartfelt conversations about being a mom in the workplace. It was community-led, unscripted, and felt like a perfect reflection of what .conf is all about: people connecting over shared passions. Cyber Games 🏁 If you missed the announcement blog earlier this year, here’s the short version: imagine an Amazing Race-meets-Capture-the-Flag competition with a Splunky twist. Two teams of Splunk customers raced through Boston landmarks solving cyber-themed puzzles, decoding clues, and taking on technical challenges — all while being filmed. Even cooler? Three of our very own SplunkTrust members were selected to play.  @marycordova  @tkopchak @jkat54 Want to know how it turned out? Check out the full video on YouTube and see which team came out on top. Ask the Experts 🎩 At the Community Zone, you couldn’t miss the folks in the signature SplunkTrust fez hats. They were everywhere answering questions, swapping tips, and helping attendees get unstuck on the spot. It was an open-door opportunity for anyone at .conf25 to bring real product questions straight to the people who live and breathe Splunk every day. Special thanks to all of these amazing people (in no particular order): @aleem @gcusello @marycordova  @alacercogitatus @meetmshah  @chris_barrett @diogofgm @obw1r3d @stboch @andygerberkp @Kasiusa  @TheLawsOfChaos SplunkTrust Induction Ceremony 🤝 One of the best traditions at .conf is welcoming a new class of SplunkTrust members. At this year’s induction ceremony, we officially recognized the 2025 - 2026 SplunkTrust cohort, which had both first-timers and returning members. Each received a brand-new fez (the ultimate SplunkTrust badge of honor) plus a swag bag of SplunkTrust-branded goodies including an Edge Hub for at-home tinkering. More importantly, they earned the recognition through countless hours of answering questions, sharing expertise, and giving back to the global community. SplunkTrust Fun at the Keynote 🎉 Conf is never short on surprises, and this year the SplunkTrust brought the fun straight to the opening keynote with a T-shirt cannon launch! A lucky few Trust members got to blast Splunk shirts into the crowd, setting the tone for the energetic days ahead. I didn’t get to fire the cannon myself, but I can confirm the excitement from the floor was real. SplunkTrust Dinner 🍽️ To cap things off, the SplunkTrust gathered for a celebratory dinner. It was a chance to relax, swap stories, and connect beyond the bustle of the conference. While one meal is never enough to thank them for everything they do, it’s always one of the most meaningful community moments at .conf. Take .conf Home with You 🏡 One important reminder came from @GretchenFox, who hosted a talk about keeping the momentum going even after .conf wraps. From the Splunk Community platform to Slack, Blogs, User Groups, Tech Talks, and Office Hours — there are so many ways to stay connected year-round. The conversations and learning don’t stop just because the conference does. Weezer at the Search Party 🎶 And of course, what’s .conf without the legendary Search Party? This year, Weezer closed out the week with a 90-minute set packed with classics, fan favorites, and even a few unexpected covers (yes, that really was Metallica and Toto). After three full days of sessions and conversations, it was the perfect way to celebrate as one big community.         Wrapping It Up ✨ Looking back, .conf25 was everything I hoped for and more: an incredible mix of energy, curiosity, and connection. From the booth to the breakout rooms to the big stage, the Splunk Community was everywhere — showing exactly what makes this ecosystem so special. I’m grateful I got to experience it all firsthand for the first time, and I can’t wait to see what’s next. Until then, thank you to everyone who came by to say hello, and I hope to see you again at .conf26! Watch .Conf25 Online! Didn't make it to conf? Or maybe you did and you want to rewatch a session or one you missed. Sessions can now be accessed here! Save the Date for .Conf26 📆 A bigger, bolder, Splunkier .conf26 is coming to Denver, Colorado, from September 14–17, 2026!  Sign up now to get the scoop before anyone else Cheers, Ryan, Splunk Community Manager ... View more

Make your learning plan before you land in Boston .conf25 is almost here! If you’re planning to boost your skills, validate your expertise, or just explore Splunk’s many learning options, here’s what you should know before you go. Earn a Certification — onsite and affordable Take advantage of $25 certification exams available throughout the week in the onsite Testing Center (Room 206 AB, Level 2). Choose from multiple time slots (Mon–Thurs), and walk away with credentials that showcase your expertise. Secure the exam times that work for your schedule, and the discount will be applied at checkout. You must be registered for .conf25 in order to qualify for this discount. Visit the Education Pavilion Stop by the Education Station for a relaxed way to explore Splunk learning options. You can even jump into “Flipping Fun” — a quick 7-second skit captured as an old-school flipbook you get to take home. Join Spotlight Sessions & Events Hands-on interactive workshops led by seasoned instructors, covering topics like Cloudtrail data exfiltration, SOAR threat intel, and machine learning for risk-based alerting. The Yin and Yang of Splunk Proficiency: a lively 20-minute talk with Renée Asselin and Eric Fusilero on balancing big-picture vision with detail-oriented execution (Sept 10, 1:00 PM). Bragging Rights Spotlight Event: a cocktail and networking hour (Sept 9, 4:30–5:30 PM) celebrating Splunk Certified attendees — meet peers, connect with execs, and get recognized for your achievements. Plan ahead with the mobile app Check the app for workshop times, certification slots, and Pavilion activities. A little prep goes a long way in making sure you don’t miss out. Download the App for iOS Download the App for Android ... View more

Hello Splunkers, .conf25 is packed with cutting-edge sessions, networking, and big “aha!” moments — but it’s not all serious business. This year, we’re turning up the fun with two high-energy, interactive competitions designed to test your skills, spark friendly rivalry, and deliver plenty of laughs. Whether you’re here to flex your technical muscles or just soak up the excitement from the sidelines, these games are fast becoming a can’t-miss .conf tradition.   PLA1029 — B.O.R.E.: Boss of Regular Expressions Tuesday, September 9 | 12:30 PM – 2:30 PM EDT Think you’ve got what it takes to be the Boss of Regular Expressions? This fast-paced challenge will put your regex skills to the test with puzzles for every level — from regex rookies to seasoned wizards. Work at your own pace, tackle beginner-friendly to expert-level questions, and watch your skills level up in real time. Expect thrilling challenges, brag-worthy victories, and yes… prizes. Get the game instructions here: splk.it/BORE_instructions Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. PLA1330 — SPLing Bee: Test Your SPL Skills in a Fun Competition Wednesday, September 10 | 2:00 PM – 3:00 PM EDT Do you know how to SPL? Step into the spotlight for the SPLing Bee, a game-show style competition where you’ll race the clock (and your peers) to solve challenges with SPL. Points are awarded for search efficiency, speed, and accuracy — so bring your A-game. This session first debuted at .conf in 2015, took a short break, and has been buzzing back since 2022. Whether you’re in it to win or there to cheer, you’ll be part of one of the most electric hours at .conf25....there will also be prizes, so bring your A(BC)...game Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Don’t miss out — spots are limited. Register now to secure your place in the .conf25 Games!   Additional Reasons to Attend .Conf25 Step Into the Future at Innovation Labs: A .conf25 Experience Like No Other Get Ready for BOTS10: The Legendary Challenge Returns to .conf25! What to Expect in the .conf25 Community Zone It's Customer Success Time at .conf25 Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25 Observability Professionals: Build Resilience and Visibility with These .conf25 Sessions Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions Calling All Security Pros: Ready to Race Through Boston? Security Professional: Sharpen Your Defenses with These .conf25 Sessions Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions 4 Ways the Splunk Community Helps You Prepare for .conf25   ... View more

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you there. Stop by the Success Zone in the Source Pavilion to see what's new with our customer success programs and offerings and earn some exclusive Splunk swag in the process.    Go on an interactive journey at the Success Zone to learn about key customer success offerings to help with developing a seamless migration to the SplunkCloud Platform, our product Adoption Hubs to help you adopt Splunk faster, new professional services offerings to help you drive value realization as well as Splunk Lantern for clear and actionable use case exploration information. Check out a new application, Insights Suite for Splunk to help get the most out of your instance with continuous analysis and trending of usage analytics, adoption metrics, performance issues, and capability analysis.   Meet key CSX staff members that will be on hand to share their insights to help you realize value with Splunk across your platform, security and observability environments.   You will also have an opportunity to answer questions about what you love about Splunk in our video booth as well as a chance for your story to appear in one of our customer focused video reels. Answer three questions in the video booth and you may earn an additional limited swag item.   It's go time at .conf25 and hope you can join us to experience all the ways Splunk is there to support you every day with our customer success and experience offerings.     Are you attending .conf25?  Register for .conf25 today Additional Reasons to Attend .Conf25 Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25 Observability Professionals: Build Resilience and Visibility with These .conf25 Sessions Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions Calling All Security Pros: Ready to Race Through Boston? Security Professional: Sharpen Your Defenses with These .conf25 Sessions Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions 4 Ways the Splunk Community Helps You Prepare for .conf25 ... View more

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've got you covered! Below is a pre-written letter you can use to request approval to attend Splunk University and .conf25. Just copy, customize with your details, and send it to your boss-highlighting all the key benefits you'll bring back to your team. It's never been easier to make a business case for joining the most important Splunk event of the year!   To: From:  Re: Approval to attend Splunk .conf25   Hi [Name], I'm seeking approval to attend Splunk University, September 6 – 8 and .conf25, taking place September 8 – 11, 2025 at the Thomas M. Menino Convention and Exhibition Center, formerly known as the Boston Convention and Exposition Center in Boston, Massachusetts (same location, new name!). This year, .conf25 is zeroing in on the user experience, offering more technical sessions, additional opportunities for me to build connections with industry leaders, discover more cutting-edge innovations, and get hands-on help with the incredible tools that I use daily in my role. I’m excited by this opportunity to bring back knowledge to our team that’ll make us more productive and efficient. By participating in .conf25, I’ll receive a year’s worth of training and education in a single week. I’ll have the opportunity to: Learn how to architect a more efficient Splunk deployment Explore new ways to approach our data analytics Examine new products and add-ons, enabling us to deliver even more value to our business, like Splunk AppDynamics Network with Splunk product experts to learn best practices and ways to solve everyday challenges Dive into security approaches to improve our security posture and protect against cyber threats Learn how to get the most out of our Splunk investments in the Observability track, and gain complete visibility and context across the full stack of infrastructure, applications, and your digital customer experience. Connect with thousands of other cross-industry attendees and hear Splunk partners talk about how to maximize the value of Splunk Take heavily discounted certification exams. Taking part in this program will help me use our Splunk platform more efficiently and effectively. The conference pass includes breakfast and lunch during the conference, effectively lowering the cost to the company. If you’d like more information about the event, visit the .conf25 website. I’m also happy to answer any questions for you. Thank you for considering this request, and please let me know if my attendance is approved at your earliest convenience. Best, Register for .conf25 today Additional Reasons to Attend .Conf25 Observability Professionals: Build Resilience and Visibility with These .conf25 Sessions Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions Calling All Security Pros: Ready to Race Through Boston? Security Professional: Sharpen Your Defenses with These .conf25 Sessions Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions 4 Ways the Splunk Community Helps You Prepare for .conf25 ... View more

  If you're focused on performance, availability, and full-stack visibility, the Observability track at .conf25 has what you need. From real-world incident response strategies to open telemetry, AIOps, and infrastructure monitoring, these sessions will help you detect problems faster and resolve them smarter. To help you navigate the catalog, we’ve curated a handful of standout sessions across experience levels and products that observability practitioners won’t want to miss. Note: Some sessions are hands-on and will not be recorded. You see a note under the listing for the ones this pertains to.  Novice-Level Sessions: Establish the Building Blocks OBS1814 – Next-Gen Observability for N-Tier Apps with Splunk AppDynamics Tuesday, Sep 9 | 12:30–1:00 PM EDT Frustrated with responding to alerts from applications without business context? Do you wish you could align your organization from business goals to performance SLO/SLIs and troubleshooting? Learn about the latest advances in Splunk AppDynamics that enable you to get full-stack observability across digital experience, application, database, and LLM monitoring. OBS1539 - Best Practices for Splunk ITSI: Configuration, Administration, and Usage Tuesday, Sep 9 | 2:30 PM - 3:00 PM EDT As seasoned Splunk ITSI experts, we've amassed best practices for optimal configuration. In this session, we'll share insights for designing KPIs, services, episodes, and AI/ML to maximize end-user experience. Whether new or experienced, you'll gain skills to use right away. OBS1528 - AI in Observability Wednesday, Sep 10 | 12:30 PM - 1:30 PM EDT Quickly resolving issues makes the difference between seamless customer experiences and interruptions. In this session, you’ll discover how Splunk O11y Cloud—augmented by Agentic AI—can root-cause incidents. You’ll see live o11y alerts flow into ITSI and use ITSI to intelligently correlate these signals with other data. Finally, you’ll see how combining O11y Cloud’s agentic AI with ITSI’s AI-driven analytics helps to ensure your critical applications stay available, performant, and resilient. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Intermediate Sessions: Expand and Connect Your Practice OBS1614 - The Observability Adventure: Tracking User Journeys and Business Processes Like a Pro Tuesday, Sep 9 | 10:30 AM - 11:30 AM EDT Your users are on an epic journey through your app, facing slow load times and complex processes. Meanwhile, your business runs on a maze of microservices, integrations, and traditional apps. In this hands-on workshop, learn how Splunk AppDynamics maps the full user journey and monitors key business processes to give you real-time insights into technical and business performance. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded.   OBS1088 – OpenTelemetry Mastery: Advanced Configuration Including Resilience, Routing, and Data Transformation Tuesday, Sep 9 | 12:30–1:45 PM EDT Master OpenTelemetry configurations and optimize your observability pipelines! Learn to create and modify OpenTelemetry configurations, from a basic setup to advanced scenarios. The workshop covers configuration of metadata, debug, file exporters, and storing telemetry data locally for better testing and debugging. Topics include routing traffic, collecting logs, enhancing agent resilience, and using data processing techniques like filtering spans and OpenTelemetry Transformation Language. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. OBS1107 - Observability for Gen AI: Monitoring LLM Applications with OpenTelemetry and Splunk Tuesday, Sep 9 | 1:30 PM - 2:00 PM EDT Unlock the power of Large Language Models (LLMs) and Generative AI to tackle real-world business challenges. In this session, dive into key concepts like embeddings, vector databases, and Retrieval Augmented Generation (RAG). Discover how OpenTelemetry and Splunk Observability Cloud empower you to capture critical metrics, logs, and traces from your Gen AI applications—enabling you to rapidly troubleshoot and optimize performance. Don’t miss out on this exciting deep dive into next-gen tech! OBS1420 – From 0 to 60: Kubernetes Observability at Full Speed with AI Wednesday, Sep 10 | 10:30–11:30 AM EDT Kubernetes is powerful, but without proper monitoring, it’s a black box. In this hands-on interactive workshop, you’ll go from 0 to 60 in Kubernetes observability, instrumenting a live K8s environment with Splunk Observability Cloud agents at full speed. No slides, just real-world monitoring. You’ll detect anomalies, uncover performance issues, and put the AI Assistant in the driver’s seat for faster troubleshooting. Buckle up and take K8s observability into the fast lane! Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. OBS1590 - Simplified ITSI Onboarding: Get Running Faster with AI Catalyst Wednesday, Sep 10 | 12:00 PM - 12:20 PM EDT Accelerate operational efficiency with Splunk ITSI. Utilize AI catalysts to streamline onboarding, enabling rapid detection and resolution of issues across applications, infrastructure, and networks. This session dives deep into leveraging ITSI's AI-driven capabilities to enhance system reliability and expedite incident resolution. Join us to learn how AI facilitates swift alert correlation and recommends accurate service health thresholds, enabling both reactive and proactive troubleshooting.   Advanced Sessions: Optimize, Automate, and Innovate   OBS1794 - Cisco Store Tech Lab Deep Dive: Behind the Scenes of How Splunk Empowered the Cisco Store Tuesday, Sep 9 | 12:30 PM - 1:00 PM EDT Cisco Store's Tech Lab proves how Cisco and Splunk transform massive data streams into real-time intelligence. Join us to see how we brought in data from disparate sources like Shopify, leveraged Cisco Meraki APIs using Cisco app integrations on Splunkbase, and built the powerful dashboards you see on the Cisco Store right now. Learn how Splunk, as part of One Cisco, delivers observability across compute, network, and apps.   OBS1091 – Hands-on with Code Profiling: Blaming the Right Line of Code for Performance Problems the First Time Wednesday, Sep 10 | 9:00–10:00 AM EDT Performance problems are easy to identify with metrics and traces, but those can't get you the root causes. In this workshop, you'll take a Java application and deploy automatic OpenTelemetry instrumentation to it. You'll then enable Splunk APM's AlwaysOn Profiling and gain insight into how user interactions affect memory and CPU usage for your applications. You'll learn how to identify the troublesome line of code, and isolate and fix a performance problem on your own. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Explore More Want the full list of observability-focused sessions? These six highlights are just a sample. The Observability Learning Path includes dozens of sessions covering modern monitoring practices, telemetry, and performance engineering. View all Observability Learning Path sessions Ready to build your full agenda? Check out the full .conf25 session catalog and filter by role, product, or learning level to find even more content tailored to observability professionals. Looking to grow beyond .conf? Explore the Observability Community Learning Path to access curated content, tutorials, and learning tools built specifically for professionals focused on visibility, reliability, and optimization. Register for .conf25 today Additional Reasons to Attend .Conf25 Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions Calling All Security Pros: Ready to Race Through Boston? Security Professional: Sharpen Your Defenses with These .conf25 Sessions Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions 4 Ways the Splunk Community Helps You Prepare for .conf25 ... View more

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to announce that Grammy-winning rock legends Weezer will be taking the stage to close out this year's conference in style. Mark your calendar: Wednesday, September 10 7-10 PM MGM Music Hall This is your chance to connect with the Splunk community, dive into groundbreaking sessions, and cap off your conference experience with an unforgettable live performance from Weezer. If you haven't registered yet, now's the time-don't miss out on the tech, the networking, or the music!   Register for .conf25 today   Additional Reasons to Attend .Conf25 Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions Calling All Security Pros: Ready to Race Through Boston? Security Professional: Sharpen Your Defenses with These .conf25 Sessions Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions 4 Ways the Splunk Community Helps You Prepare for .conf25   ... View more

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your workflows, .conf25 is packed with technical sessions designed to push your skills further. This year’s Developer track has something for every builder—from hands-on AI workshops to best practices for app certification. To help you make the most of your conference experience, we’ve highlighted six standout sessions tailored specifically for developers—organized by learning level to help you find the best fit for where you are now, and where you want to go. Novice-Level Sessions: Build Your Foundation in Splunk Development   DEV1913 - SPL2 Apps: The New Kid In Town Tuesday, Sep 9 | 12:30 PM - 12:50 PM EDT What can you do with an SPL2-based app that you can’t do with an SPL app? Design multiple searches, either chained or branched, in a single interface file. Curate data and employ sensitive data masking for specific user roles. Create extensible and reusable custom functions. Seamlessly handle JSON data. Use partitioned functions to define a single function with a default behavior but with multiple implementations based on the value of a variable. DEV1226 – Dive Into App Development with the New Splunk Developer Program September 9 | 2:00–2:20 PM EDT Got a great idea for your next Splunk app but struggling on where to get started? Look no further than the new Splunk Developer Program! Whether you are lost on where to get started, looking for the community to share your work with, or hoping to promote your apps and build your reputation, the Splunk Developer Program will be your one-stop shop. In this session, you’ll get a first look at all you can achieve and access with this new free program launching now! DEV1938 – AI Exploration: MLTK, DSDL App, and AI Assistant in Splunk September 10 | 12:30–1:30 PM EDT Join a hands-on workshop to integrate Splunk with Jupyter notebooks and discover how powerful Splunk is for using and optimizing your AI models. We'll provide the code to set up your first model and import it as ONNX. With Splunk you'll train, test, and tune to produce great visualizations that are easy to explain. We'll use the Assistant to generate SPL from natural language, and explore data for anomaly detection and more real-world scenarios. No data science expertise required! Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Intermediate Sessions: Strengthen and Scale Your App Development Skills   DEV1390 - From Idea to Seamless Deployment & Publishing: Splunk App Development Insights from ENGIE France Retail Tuesday, Sep 9 | 3:00 PM - 3:45 PM EDT Discover the full journey of Splunk app development—from idea to deployment. Learn best practices for performance, security, and compliance while optimizing searches and enhancing UI/UX. Explore real-world insights from ENGIE’s use of Splunk, tackling challenges in Cloud and Enterprise environments. Finally, master the Splunkbase publishing process with step-by-step guidance on validation, certification, and increasing your app’s visibility. DEV1483 – Splunk UI Toolkit: Custom Problem to Custom Splunk App September 9 | 10:30–11:30 AM EDT Have you been craving a specific user experience that extends beyond normal dashboards? Learn how Lockheed Martin unlocked a standardized alert triage workflow by building a custom Splunk app using the Splunk UI Toolkit: a set of free, public React packages used in many Splunk products you know and love. Follow along in this workshop as we guide you from a real-life business problem to a full-fledged custom Splunk app, while acquiring practical tips to implement at your own company. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. DEV1455 – Fly Through AppInspect: Best Practices to Help Keep Your App Secure and Compatible With the Splunk Platform September 10 | 1:30–2:15 PM EDT Go from zero to hero in this session with an AppInspect engineer. Learn the ins and outs of AppInspect, including checks and tags, the API, CLI, and documentation, so you can secure and certify your app confidently. Advanced Topics: Power Up with AI, ML, and CI/CD   DEV1666 – AI Agents Unleashed: Build Your Splunk-Powered Sidekick in One Explosive Workshop September 10 | 11:00 AM–12:00 PM EDT Struggling with manual Splunk data digs? In this workshop, build an AI agent with LangChain's LangGraph to search, analyze, and extract insights from Splunk Enterprise Security in real time. Clone a GitHub template, code custom tools to query Splunk, tap its API, and download Splunkbase apps, all in one session. Bring your laptop and leave with a game-changing skill! Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. DEV1601 – Mastering Splunk Add-Ons: Contribute and Collaborate Efficiently September 9 | 1:00–1:20 PM EDT Join us for an engaging and practical session on contributing to Splunk Add-ons. This session will guide you through the contribution process, best practices, and CI/CD tooling to ensure high-quality outputs. Whether you're a beginner or an experienced developer, you'll understand how to submit impactful contributions, test efficiently, and collaborate with the Splunk community. Explore More Want the full list of developer-focused sessions? These six picks are just the beginning. The Developer Learning Path includes a wide variety of sessions designed to help you build, test, and optimize your Splunk apps. View all Developer Learning Path sessions Ready to build your full agenda? Check out the full .conf25 session catalog and filter by role, product, or learning level to find even more content tailored to developers. Looking to grow beyond .conf? Explore the Splunk Developer Community Learning Path to access curated year-round content, tutorials, and tools that support your growth across the full development lifecycle. Let’s make .conf25 your most impactful conference yet. Security threats won’t wait—and neither should you. Register Now ... View more

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your moment to level up. Whether you’re just getting started or deep in the weeds of detection engineering, this year’s conference is packed with content designed to help you sharpen your skills, modernize your SOC, and stay ahead of evolving threats. With 200+ sessions across all skill levels, it can be overwhelming to know where to start. That’s why we’ve curated a list of sessions sorted by learning level spanning across different products that Security Practitioners won't want to miss.  Just Starting Out? These Novice Sessions Build a Strong Foundation   SEC1523 - Power the SOC of the Future with Splunk Security Wednesday, Sep 10 | 11:30 AM - 11:50 AM EDT  Join us for an engaging session on how Splunk powers the SOC of the future by integrating people, processes, and technology to build digital resilience. Discover how a resilient SOC delivers visibility, context, collaboration, and faster resolution. Learn about threat detection, accelerated investigations, and automation to contain threats. Explore how AI-guided solutions and Cisco’s advanced security capabilities strengthen your digital footprint. SEC1638 - From Request to Response: Mastering Security Data Onboarding Tuesday, Sep 9 | 12:30 PM - 1:15 PM EDT  Security data onboarding isn’t just about collecting logs—it’s about making sure you’re bringing in the right data for the right reasons. This talk will cover the full journey: handling onboarding requests, evaluating data sources, and improving onboarding maturity. Using a use case-driven approach and simplified threat modeling, we’ll show you how to align your security data onboarding with real security goals and monitoring needs.   SEC1276 - Building the Pathway to Simplify the SOC with Splunk Wednesday, Sep 10 | 9:00 AM - 9:20 AM EDT  When thinking about a highly advanced SOC, TDIR comes to mind. TDIR stands for Threat Detection, Investigation, and Response. You definitely don't want it to be Tedious, Daunting, Irritating, and Repetitive. But that's what happens when you try to stitch together too many separate tools. Join this session to learn how Splunk can help your team achieve a better approach to TDIR and help you build the SOC of the Future!   SEC1120 - S3crets in the AWS Cloudtrail: Unraveling Data Exfiltration One Event at a Time Wednesday, Sep 10 | 2:00 PM - 3:00 PM EDT  Your data left the cloud, but who took it, and how did they get in? In this hands-on session, you’ll start with a single event (your first clue of data exfiltration) and work backwards to uncover the full attack sequence. Security defenders and threat hunters, get ready to sharpen your investigative skills by following unauthorized users, privilege escalation, defense evasion, and more. Piece together security events, suspicious patterns, and uncover s3crets hidden in the AWS Cloudtrail! Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Intermediate-Level Security? Elevate Your Skill Set with These Intermediate Picks SEC1123 - Enterprise Security 8.1: Enhanced Detection and Investigation for the SOC Tuesday, Sep 9 | 10:30 AM - 11:30 AM EDTBad actors thrive on chaos, but luckily Splunk Enterprise Security offers enhanced detection and investigation capabilities. In this interactive workshop, attendees will be introduced to these capabilities and will learn how to review findings, start an investigation, conduct analysis, and set the investigation's status, urgency, and sensitivity, shortening mean-time-to-respond. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded.   SEC1467 — Risk to Rewards: Apply Machine Learning to Enhance Risk-Based Alerting Tuesday, Sept 9 | 12:30–1:45 PM EDT Congratulations, you made the big transition to risk-based alerting. Your focus is now on risk objects so you can reap the rewards of a reduced number of notables. Learn powerful techniques such as clustering risky objects, identifying risk scores, and detecting firewall exploitation by malware. Join us and learn how to apply these machine learning methods for greater insight into your organization's risk posture. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. SEC1196 — The Automation Games: An Interactive Workshop with Splunk® SOAR Wednesday, Sept 10 | 10:30 AM–12:30 PM EDT Let's get ready to automate! The Automation Games provides a peek into how automation and orchestration features in Splunk® SOAR can help security teams automate repetitive tasks, respond to security incidents faster, increase productivity and efficiency, and strengthen defenses across your organization. The Automation Games are a fun and challenging competition among peers who want to learn how to leverage Splunk® SOAR in their security operations. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. SEC1929 - Rebooting Splunk UEBA: Leveraging the New UEBA’s AI/ML Models Wednesday, Sep 10 | 9:00 AM - 9:45 AM EDTHelp your team effortlessly find the needle in your existing data haystack. Learn how you can really use the AI/ML behind Splunk’s newly rebooted user and entity behavior analytics (UEBA) module to power better detections at scale while using all of your existing data. If you'd like to better detect lurking risks without developing your own advanced AI powered logic, join this session to learn about UEBA's recent (re-) evolution, development, and real-world applicability. Seasoned Expert? These Advanced Sessions Will Push You Further   SEC1636 — print(f"Hello, {attendee_name}. Let's Automate!") : Using Detection as Code to Manage Your Content Development Lifecycle Tuesday, Sept 9 | 11:00–11:20 AM EDT Detection Engineering is hard and "click ops" is just not good enough to keep up with the needs of the modern security operations environment. Yaml, Python, GIT, and the CI/CD pipeline have entered the DaC chat! We'll help you by demonstrating how to build yaml code files with a common schema, how you can test your rules, and post them to Splunk. Join us and learn how to take your content management procedures from zero to hero using these common household items and a little "can do" spirit. SEC1224 — Mastering the Detection Engineering Lifecycle: From Data Ingestion to Detection Triumph Wednesday, Sept 10 | 1:30–3:15 PM EDT Unlock the full potential of your security operations team in this comprehensive workshop on detection engineering. Dive into the critical steps of getting data into Splunk, learn how to build robust detections, and explore the entire detection engineering lifecycle. Whether you are just getting started or refining your poses, this session will provide practical insights and strategies for turning raw data into actionable intelligence and enhancing your organization’s security posture. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. SEC1519 - Diving into Splunk Attack Analyzer Data: 15 Crazy Reasons to Ingest More Phish Tuesday, Sep 9 | 2:15 PM - 4:00 PM EDT Join us for an engaging, hands-on session where we dive deep into the vast ocean of telemetry produced by Splunk Attack Analyzer. We will pull back the curtain on the various engines in SAA and go through the TA sourcetype by sourcetype. We’ll reveal the data lurking in the depths and sail through ways to use it to address credential phishing and more. Attendees will gain practical experience and unlock new use cases powered by SAA and the broader Splunk security stack. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Explore More   Want the full list of security-focused sessions? These six picks are just the beginning. There are over 20 sessions curated specifically for the Security Learning Path at .conf25—covering everything from SOAR to risk-based alerting to Detection-as-Code. View all Security Sessions  Ready to build your full agenda? Check out the full .conf25 session catalog and filter by role, product, or learning level to find even more tailored content. Want to keep leveling up all year long? Explore the Security Community Learning Path to access curated content, training, and resources designed for security practitioners just like you. Let’s make .conf25 your most impactful conference yet Security threats won’t wait—and neither should you Register Now 🙂 ... View more

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology movement of our lifetime. The recent pace of advancements in AI has a transformative power that is more profound than anything I have seen before. It is more critical than ever for organizations to keep up with these new AI opportunities, while also understanding the complexities that they bring.   The Agentic AI Era Demands Resilience Solving these challenges to ensure digital resilience for organizations is why I came to Splunk. The solution requires three key components: Data at scale, unified and contextual Agentic AI for autonomous, cross-domain analysis, reasoning, and action Interoperability to break down silos Data at Scale, Unified and Contextual  The synergies between Splunk and Cisco for delivering the value of data at scale, unified and with context for customers, cannot be found anywhere else. Much of the world’s machine data runs through Cisco networks, bringing unmatched visibility from infrastructure telemetry across networks, security, and applications, with the reach needed to connect the entire digital economy. Splunk is a market-leading data platform that processes petabytes of machine data every day. Splunk offers unmatched capabilities to access, normalize, and correlate machine data, turning fragmented data silos into a unified, real-time view with context for actionable insights at a massive scale.  Agentic AI for Autonomous, Cross-Domain Analysis, Reasoning and Action In terms of agentic AI, this is where Cisco and Splunk will shine by infusing agentic ability to autonomously reason, adapt, and act to supercharge our product portfolio and also create new solutions.   We have been working to revolutionize Splunk’s data platform with AI-native capabilities to manage the entire machine data life cycle from visibility to insight. We are laying the foundation for agentic SOC, observability, and network assurance, all while providing important guardrails to help improve AI application stack security, compliance and performance. The power of AI will ultimately come from your data, and we’re working fast to make it even easier for you to use your data to customize AI for your business. Interoperability to Break Down Silos Breaking down silos with interoperability and extensibility is table stakes. This is core to Splunk’s DNA—from REST APIs and SDKs, federation across other data sources and hybrid environments, to supporting open standards like OTel (Open Telemetry) and OCSF (Open Cybersecurity Schema Framework). We are adopting emerging open AI standards, like Model Context Protocol (MCP), A2A, and others, to allow for easier connections between agents and the Splunk platform. Related to this, we recently announced the release of MCP server for Splunk Cloud Platform—look for more to come in this area. Interoperability is crucial for gaining complete data insights to close blind spots and improving productivity by automating process workflows. Let’s not forget this is a human revolution, too. Agentic AI should act as an assistant to surface insights, automate routine actions, and allow analysts and engineers to focus on higher-value work. Human-in-the-loop (humans added into the AI workflow) and human-on-the-loop (humans managing agents) frameworks help ensure that AI-driven actions are always guided by organizational context, values, and policies. When you take into account how Splunk and Cisco can deliver the combination of these three elements, the result is the new foundation for an AI-native Splunk!   Your Invitation to .conf25 in Boston Don’t miss your chance to be part of Splunk’s biggest event of the year! Register now for .conf25 in Boston, Sept. 8–11, to see groundbreaking innovations unveiled, connect with industry leaders like Jeetu Patel, and get hands-on with the next generation of Splunk solutions. Secure your spot today and help shape the future of digital resilience! ... View more

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 offers a wealth of opportunities to sharpen your skills and streamline your workflows. From platform upgrades and data federation to AI assistants and SPL mastery, there's something here for every admin at every level. With over 200 sessions in the full catalog, we’ve handpicked six standout sessions tailored specifically for Splunk Platform Administrators—organized by experience level to help you focus on what matters most.   Novice-Level Sessions: Start with Strong Fundamentals   PLA1317 – Splunk AI Assistants in Action: A Hands-On Deep Dive September 9 | 12:30–1:30 PM EDT Come get hands-on experience with all three of Splunk’s AI Assistants! In this workshop, we'll provide real-world use cases you can plug into your daily workflows, streamlining your operations and helping you become a Splunk Ninja. Curious how these assistants work? In addition to practical use cases, we’ll also peek under the hood to see how they operate and why we believe they outperform other AI tools. Walk away ready to put Splunk AI to work! Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. PLA1271 – 30 SPL Commands in 90(ish) Minutes September 10 | 2:30–4:30 PM EDT For anyone who writes or edits searches, one of the hardest problems is just having basic familiarity with the various commands available. Also, knowing when not to use a specific command can save a lot of headaches. From "append" to "xyseries," we’ll take a quick tour around the 30 most common and useful commands in SPL. We’ll show you what each one does, when to use it, and when to avoid certain commands. If time permits, we'll also cover some bonus material! Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Intermediate Sessions: Boost Efficiency and Stay Ahead   PLA1270 – Administrator's Anonymous Speed Run: Improve Your Splunk Experience in 15 Minutes or Less September 9 | 10:30–10:50 AM EDT You're a busy admin who demands the most from your Splunk environment. Join this no-nonsense talk led by one of our SplunkTrust experts and learn three Splunk tips to improve the performance, efficiency, and health of your Splunk environment in less than the time it takes to order lunch. PLA1535 – Upgrading to Splunk Platform 10 September 9 | 4:15–5:00 PM EDT Have you been putting off upgrading to 10? We get it, but you gotta. In this session, we’ll go over the great new features in this version of Splunk Enterprise and Splunk Cloud 10, how to tell if you’re impacted by any major changes, and what to do to prepare for a seamless update. PLA1275 – A Deep Dive Into SPL2: How Does It Actually Compare to SPL? September 10 | 1:30–2:15 PM EDT """SPL + scripting language concepts + (optional) SQL = SPL2!"" Sure, that's a nice catchphrase. But how does SPL2 actually compare to SPL? What's in SPL2 that isn't in SPL, and why should you care? Join this session to go deep into SPL2 and its capabilities for everyone from analysts to developers. Learn about its syntax modes (SPL and SQL), functions, data types, imports and namespaces, lambda expressions, and the problems they solve across multiple Splunk streaming and search tools. PLA1968 – Edge Processor on Splunk Enterprise 101 September 9 | 2:15–3:15 PM EDT Whitepapers and docs can only take you so far when evaluating potential solutions — eventually, you'll have to get your hands dirty. Come experiment with the various out-of-the-box metrics that Edge Processor emits and see how it can address your data management needs. Note: This is an Interactive Workshop Session. Please bring your own laptop to dive into product use cases, walk through real scenarios and demo as you go. Attendance is capped based on content and sessions will not be recorded. Explore More Want the full list of admin-focused sessions? These six picks are just the beginning. There are several sessions curated specifically for the Admin Learning Path—covering everything from upgrades and SPL to data federation and AI. View all Admin Learning Path sessions Ready to build your full agenda? Check out the full .conf25 session catalog and filter by role, product, or learning level to find even more content that’s right for you. Looking to grow beyond .conf? Explore the Admin Community Learning Path to access curated year-round content and keep your Splunk skills sharp long after the conference ends. Let’s make .conf25 your most impactful conference yet. Security threats won’t wait—and neither should you. Register Now ... View more

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the Splunk Community is one of your best resources for making the most of your experience. Here are four ways to get prepared — with a little help from your peers. 1. Discover Your Learning Path .conf25 is packed with content — over 200 sessions across dozens of tracks. Not sure where to start? The Splunk Community Learning Paths help you focus on what matters most based on your role. Each path is built for a specific audience: Platform Admins looking to optimize deployments and drive value Security Pros staying ahead of threats with Splunk’s latest tools Developers building apps, integrations, and automations Observability Experts wrangling complex environments and driving performance 🔍 Start with the path that fits your role, then explore our role-specific community blog posts that break down must-see sessions. 👉 Explore Learning Paths 2. Get the Insider Perspective Want to hear what sessions other community members are excited about? Need help choosing between two can’t-miss workshops? The Splunk Community is full of people who’ve been to .conf before and are happy to share tips. Check the conf25 Slack channel, or jump into comments on our blog posts to hear what your peers are planning — 💬 Tap into real talk from real people who’ve been there. 👉 Join the Community Slack 3. Plan Smarter With Community-Curated Content We’re doing the homework so you don’t have to. Over the next four weeks, we’re highlighting .conf25 sessions from each of the four Learning Paths. They will include sessions not only specific to Learning Paths but also your Splunk experience level.  📅 New .Conf25 posts will drop every Tuesday from July through early September — so keep checking back! 4. Connect Before You Arrive Splunk Community isn’t just for event prep — it’s where the learning and networking continue long after the lights go down in Boston. But don’t wait until .conf25 starts — the conversation has already begun. Say hello in the Community Slack channels, or Answers forums for your Learning Path. Ask questions. Make a plan to meet up. Or just lurk — we won’t judge. 👋 This is your chance to find your people. Final Thoughts .conf25 is more than just an event — it’s your opportunity to grow your skills, meet your peers, and see what’s possible with Splunk. And with the Community by your side, you don’t have to figure it all out on your own. Let’s get ready, together. Register Now   Still need approval to attend .conf25? We’ve got your back — Splunk has created a ready-to-send "Convince Your Boss" email template. Personalize it with your goals and get the green light to attend. ✉️ Get the Letter to Convince Your Boss (Click on the "Details" tab to find the letter) ... View more

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which means you can now start submitting feature requests for AppDynamics. How do I access the Splunk Ideas Portal? You can access the Splunk Ideas Portal here. You sign in by using your existing Splunk Account credentials or creating one here.  Did all the existing Ideas get migrated over into the new platform? Yes, all Ideas that were previously submitted on App Dynamics’ Idea Exchange are migrated onto the Splunk Ideas Portal.  Can I see the Ideas I submitted on the old Idea Exchange? Yes, you can find previously submitted Ideas by searching the Idea name on the new portal.  How do I submit new ideas to Splunk Ideas? Please log in using your Splunk Account to access the portal, and click the ‘Add New Idea Button’ to submit an Idea for any GA Splunk product. If you have any questions, please engage with the Splunk Ideas team over on the Slack usergroup #ideas channel. ... View more