We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, where should it go, and how will anyone find it again. When data spans sources and workflows, answering those questions takes a few capabilities working together. Welcome one, welcome all! Introducing, The Data Connection, a monthly look at what is new across Splunk data capabilities. This series builds on our monthly Data Management Digest blog (take a look at Sept, Aug, July, June, May editions), expanding our focus to bring Data Management, Federated Search, Machine Data Lake and Catalog into one connected story – one place for you to find launch announcements, innovations, events, and practical content! These are complementary capabilities within the same data approach. Data Management prepares and routes data. Machine Data Lake provides a governed place to retain it and promote it when needed. Federated Search lets teams query data across supported locations. Each capability plays a different role, which is why we are bringing their stories together. Each capability answers a different question: Data Management: How should data be prepared, governed, and routed? Machine Data Lake: Where can machine data be retained and promoted when needed? Federated Search: How can teams query data across different locations? In addition, the Splunk Catalog can complement this approach by helping teams discover datasets and understand their metadata across the data estate. Together, they help teams manage data according to its value, location, and intended use, while reducing unnecessary movement and duplication.   What's new in Data Management From preparing and routing data to making onboarding easier, here are this month's Data Management updates and resources. Guided Onboarding and Auto-Schematization expand to six more regions Guided Onboarding and Auto-Schematization (Auto-Schema) are now available in six additional Splunk Cloud Platform regions: AP Sydney, Canada Central, EU London, India Mumbai, AP Tokyo, and AP Singapore. This brings availability to 12 total regions! Guided Onboarding recommends an approach for preparing data for security, observability, and analytics. Auto-Schematization analyzes sample data, recommends CIM mappings, and helps customers refine schemas and generate deployment artifacts, with recommendations available for review. Learn more about how Guided Onboarding and Auto-Schema can save you time while getting data into Splunk: Using AI to auto-schematize raw log data into CIM-compliant add-ons and Normalizing values to a common field name with the Common Information Model Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path Running Edge Processor in hybrid mode alongside a Splunk heavy forwarder on the same host raises practical questions: how much data can the node move, and which setting should you adjust when capacity is not enough? We put hybrid Edge Processor through performance testing on each of the four ways data reaches it: forwarded data over Splunk-to-Splunk (S2S), HTTP Event Collector (HEC), TCP syslog, and UDP syslog. Dive into this blog to learn how this was measured, what limits each path, and the settings that raise the ceiling. REGISTER HERE: Community Office Hours for simplify onboarding and pipeline operations In this upcoming Community Office Hours session, Splunk experts discuss how AI and agentic capabilities can simplify data onboarding, schematization, and pipeline operations. The session covers how AI-Powered Data Management can guide administrators through onboarding workflows, automate schema generation and CIM mapping, and help monitor and manage pipeline health with less manual effort. Register now!   What's new in Federated Search Federated Search lets teams query data across supported locations. This month's updates include new ways to extend where teams can search. Federated Search for Dynamic Data Self Storage is generally available Federated Search for Dynamic Data Self Storage is now generally available on Splunk Cloud Platform 10.5 in AWS Commercial regions. Customers can use SPL2 to search eligible Splunk datasets in their own AWS S3 storage without first restoring them to a Splunk index. That gives security, compliance, and operations teams faster access to historical data for investigations, audits, and reporting, while reducing manual restoration work and duplicate data movement. Glacier Flexible Retrieval and Glacier Deep Archive still require bulk retrieval before data can be queried. Federated Search for Cisco Security and Analytics Logging (SAL) Federated Search for Cisco Security Analytics and Logging (SAL) is now generally available with Splunk Cloud Platform 10.6.x for eligible AWS environments in supported commercial regions. Security teams can search supported Cisco Secure Firewall events stored in SAL directly from Splunk Cloud, without ingesting the source logs into their Splunk deployment. This brings historical firewall context into threat hunting, incident response, troubleshooting, and audit workflows while allowing teams to retain high-volume logs in SAL and correlate them with other data in Splunk. Federated Search for Snowflake Is Now Generally Available Federated Search for Snowflake is generally available on Splunk Cloud Platform 10.5 in AWS Commercial regions. Teams can search Snowflake data in place with SPL2 and correlate it with Splunk data in a familiar search experience—bringing business and historical context into security, observability, and compliance workflows without unnecessary data movement or duplicate copies. Guided setup and Snowflake-optimized queries help simplify connections and reduce avoidable data transfer. Want to search Snowflake data from Splunk Cloud? Explore the announcement. Check out the release notes for more detailed information. Federated Search for CloudWatch Unified Data Store is now generally available Federated Search for CloudWatch Unified Data Store is now generally available on Splunk Cloud Platform 10.6 in AWS Commercial regions. Teams can search their data stored in CloudWatch tables in place with SPL2 and correlate it with Splunk data in a familiar search experience—bringing business and historical context into security, observability, and compliance workflows without unnecessary data movement or duplicate copies. Guided setup and CloudWatch tables-optimized queries help simplify connections and reduce avoidable data transfer. Check out the official documentation for more detailed information. On-Demand Community Office Hours: Federation 2.0 Looking for the right way to get started with Federated Search? In this on-demand Community Office Hours session, Splunk experts explain Federation 2.0 and the options across Splunk environments and external data stores. Learn how to get started, choose an option for your data and use case, and explore search across Amazon S3, AWS CloudWatch, Dynamic Data Self Storage, Cisco SAL, Snowflake, Microsoft Azure, and Azure Databricks. As a reminder, the Splunk platform currently offers 9 federated search options: Federated Search for Splunk Federated Search for Amazon S3 Federated Search for Microsoft Azure Federated Search for Azure Databricks Federated Search for DDSS Federated Search for Snowflake Federated Search for Cisco Security Analytics and Logging Federated Search for CloudWatch Unified Data Store Federated Analytics for Amazon Security Lake   What's new in Catalog Catalog gives teams context across the data estate, helping them find and understand the data they need. Dataset and connection management in Catalog is generally available Catalog already helps Splunk Cloud Platform users discover data across Splunk indexes, federated sources, and Machine Data Lake, and promote Machine Data Lake data for analysis. With Splunk Cloud Platform 10.7, admins and data owners with edit permissions can now also onboard and manage Machine Data Lake raw datasets and federated datasets, along with their source connections, without leaving Catalog. Teams can connect a source, create a dataset, and keep it up to date in the same place they find and promote it. Existing Data Management pages for datasets and connections now redirect to Catalog, with access controls and auditing preserved. The result is one connected experience from onboarding to analysis, so teams spend less time switching tools and more time putting data to work. Check out the release notes and what’s new in Splunk Cloud Platform 10.7 for more details. New to Catalog? Read the Catalog General Availability announcement to learn about its discovery and promotion capabilities.   What's new in Machine Data Lake Machine Data Lake provides a governed place to retain data and promote it when needed, with a consistent workflow for discovering, querying, and managing datasets. Keep Analytics Tables Updated as New Data Arrives Continuously promote new data from Machine Data Lake raw datasets into an Iceberg-based Analytics Table. As additional streaming data comes in, the table stays updated, giving teams a reusable foundation for recurring analysis, summary workloads, scheduled alerting, and long-term queryable retention. Admins can pause the promotion, validate the changes, and resume the same job. Data arriving during the pause stays in MDL Raw; resuming doesn’t automatically backfill it into the index. This helps teams put selected Machine Data Lake data to work in ongoing analytics, with visibility and control over the promotion lifecycle. Update Streaming Promotions Without Recreating the Job Operators can make supported transformation changes to an existing streaming promotion to a Splunk index through a validation workflow, then resume the same logical job. This preserves the job’s identity, owner, destination, and audit history, helping reduce disruption and avoid rebuilding the route. Check out the release notes and what’s new in Splunk Cloud Platform 10.7 for more details. Keep the conversation going! For questions, connect with our experts in the community Slack channels #dm-pipeline-builders, #federated-search, or #splunk-cloud. ... View more

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of momentum to data management. Edge Processor Hybrid gives teams a way to modernize ingestion while keeping trusted Heavy Forwarder workflows; S2S ACK adds stronger delivery assurance for eligible paths; and new AI add-ons help bring activity from popular and self-hosted AI platforms into Splunk. Add Splunk Platform 10.6 updates and a .conf26 rewind, and there’s plenty to catch up on. Let’s get into it! As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What’s new in Data Management: Introducing the Launch of Edge Processor in Hybrid Mode! Keep the Heavy Forwarder parsing, timestamp extraction, Technical Add-ons, and ingest-time configurations your teams already depend on while adopting Edge Processor and SPL2 processing on the same server. This gives you a gradual way to modernize your ingestion architecture and reduce migration effort and operational risk. Learn more here!   Improve Delivery Assurance with S2S ACK for Edge Processor For supported Edge Processor on Cloud paths, S2S ACK helps you avoid data loss by confirming receipt and supporting at-least-once delivery behavior. You can also monitor acknowledgements, latency, queue growth, and backpressure to spot delivery issues sooner. The feature is in Controlled Availability; validate it with representative workloads before broad rollout. Dive into this topic here.   Close AI Monitoring Blind Spots with OpenAI and Anthropic Add-Ons Give security and operations teams a clearer view of AI activity, including user actions, configuration changes, and API key events across OpenAI and Anthropic environments. Bring those signals into Splunk to correlate them with identity and security data, support investigations, and extend visibility to multiple providers and self-hosted models. Introducing Splunk Cloud Platform 10.6 and Splunk Enterprise 10.6 The Splunk Platform 10.6 releases also include updates across security, administration, federated search, and data management. If your scripts or integrations parse version strings, check compatibility as you plan an upgrade. Learn about the new features and enhancements here! We specifically want to highlight new Data Management APIs, which are now available in both Splunk Cloud Platform 10.6 and Splunk Enterprise 10.6: Automate repeatable data management workflows with Data Management Service APIs Data Management APIs give customers and partners a supported way to automate common Edge Processor and Ingest Processor workflows across cloud and on-premises deployment paths. Repeatable automation can shorten onboarding, reduce configuration drift, and make data management easier to integrate into broader platform engineering practices. Customers and partners can spend less time reproducing administrative steps and more time improving how data is filtered, routed, and prepared for use. Learn more here.   That’s a wrap on .conf26! Missed the magic? Catch up on the keynotes and sessions: https://conf.splunk.com/global-broadcast-replays.html .conf27 is going to Chicago! We’re headed to the city known for delicious deep-dish pizza, pro sports, and bluesy music. Join us at the McCormick Place Convention Center October 4–7, 2027 to meet Splunk experts in person and get your problems solved, deepen your expertise, and have fun with fellow Splunk users. Make sure you're the first to know when registration goes live. Get notified.   Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below. ... View more

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month for Splunk Data Management, and this edition is packed. We’re covering new Splunk Platform innovations supporting Cisco Data Fabric, AI-powered Data Management capabilities that make machine data easier to onboard, prepare, and trust, expanded OpenTelemetry Collector support for Linux and Windows host telemetry, Edge Processor Hybrid, S2S ACK for reliability-sensitive pipelines, and new Data Management APIs for automation. Whether you’re focused on data onboarding, pipeline reliability, agent strategy, or preparing your environment for AI-ready use cases, this month’s Digest brings the major updates together in one place so you can catch up quickly and dig deeper where it matters. As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What’s new in Data Management New Splunk Platform Innovations Supporting Cisco Data Fabric Are Generally Available At .conf25, we announced our vision for Cisco Data Fabric, an architecture designed to help organizations unlock the value of machine data, fuel AI with trusted context, and support more intelligent and resilient operations. Now, that vision has become reality. Key Splunk Platform innovations including Machine Data Lake, Catalog, and Agent Launchpad, together with expanded Federated Search and Data Management capabilities, are now generally available. You can begin using these Splunk Platform innovations today to federate data, correlate at scale and unlock machine data for AI. Learn more about all the announcements, here, and dive into the AI-Powered Data Management GA announcement below! Making Machine Data Easier to Onboard, Prepare and Trust with AI-Powered Data Management This month’s top story is all about making machine data easier to work with from the start. Splunk announced new AI-powered Data Management capabilities that help teams move from raw, changing machine data to trusted, search-ready signals faster, with less manual effort and more confidence in data quality. These updates support the broader Cisco Data Fabric powered by the Splunk Platform by helping customers onboard data faster, structure it more consistently, monitor data quality over time, and keep the data behind investigations, detections, dashboards, and AI-assisted workflows accurate and usable. What’s included in this launch: Guided Onboarding with Auto-Schematization is now generally available Guided Onboarding with Auto-Schematization, or Auto-Schema, gives admins a more opinionated path from onboarding intent to search-ready data. It helps teams plan the right onboarding approach, analyze representative sample events, recommend mappings, generate field extraction logic, and create reviewable outputs such as add-on packages or SPL2 templates. See it in action: Start with the data onboarding walkthrough to see how the guided workflow helps administrators move from onboarding intent to a recommended path. Then explore the Schematize custom data walkthrough to see how representative events can become recommended mappings and reviewable configuration outputs. Self-Healing Pipelines are now generally available with Splunk Ingest Monitoring 1.4.0 Self-Healing Pipelines help teams keep onboarded data useful over time by detecting CIM compliance drift, analyzing likely root causes, and surfacing AI-assisted remediation recommendations. Admins can review proposed updates in a side-by-side diff view, preview the results, and download a ready-to-install add-on overlay package without modifying the original add-on. See it in action: Watch the Self-Healing Pipeline for CIM compliance walkthrough to follow the path from detected drift to reviewable remediation. Automated Field Extraction remains in Controlled Availability Automated Field Extraction uses AI to help reduce the manual work of identifying fields, writing regular expressions, and preparing custom data for downstream use. It is designed to help teams get to usable data faster while reducing the specialized effort often required for custom field extraction. Why it matters Getting data into Splunk is only the first step. The real value comes from making that data structured, accurate, governed, and ready for action. These new AI-powered Data Management capabilities help reduce onboarding guesswork, speed up configuration work, detect quality issues earlier, and keep machine data trustworthy as environments change. One Collector, Two Operating Systems, Fewer Agents to Manage We’re excited to share that Splunk OpenTelemetry Collector support for Linux and Windows host logs and metrics Is now available as a fully supported, production-ready path for Splunk Platform customers! This is an important step toward a simpler, open, and unified telemetry collection strategy. Customers can now use the Splunk OTel Collector to collect host telemetry from both Linux and Windows environments, helping reduce agent sprawl, standardize on OpenTelemetry, and bring trusted operational data into Splunk for security, observability, and AI-ready use cases. How does it work? Customers can collect Linux host logs from sources such as `/var/log/*`, journald, and audit logs, along with infrastructure metrics such as CPU, memory, filesystem, disk I/O, network traffic, process information, and uptime. For Windows hosts, customers can collect Windows Event Log data and supported Windows host telemetry sources through the Collector pipeline. The customer value is straightforward: one OpenTelemetry-based collection tier for host logs and metrics across Linux and Windows, fewer agents to manage, more consistent deployment patterns, and better alignment with modern observability standards. The Universal Forwarder remains the recommended option for Splunk technical add-ons and solution-specific use cases such as Enterprise Security or ITSI, while the Splunk OTel Collector is now the supported path for modern host telemetry collection.  Introducing Edge Processor Hybrid We're excited to announce Edge Processor Hybrid, a new evolution of Splunk's data ingestion architecture that combines the trusted capabilities of Heavy Forwarder with the flexibility and innovation of Edge Processor. This unified approach enables organizations to modernize their ingestion infrastructure without rewriting existing data pipelines or disrupting proven operational workflows. Edge Processor Hybrid preserves the capabilities customers rely on today—including timestamp extraction, event parsing, Technical Add-ons (TAs), advanced line breaking, and end-to-end S2S acknowledgements—while providing a path to adopt modern SPL2 processing at their own pace. By consolidating forwarding technologies into a single server, customers can reduce infrastructure footprint, lower operational overhead, and simplify management while maintaining the enterprise-grade reliability Splunk is known for. Organizations benefit from fewer servers to manage, lower migration risk, preserved investments in existing configurations, and a scalable foundation for future data processing innovation. Edge Processor Hybrid helps organizations modernize faster, simplify operations, and maximize the value of their existing Splunk investments—without starting over. More Confidence for Reliability-Sensitive Data Flows with S2S ACK We’re excited to announce that Splunk-to-Splunk acknowledgement (S2S ACK) is now available as an opt-in Controlled Availability capability for supported Edge Processor-on-Cloud S2S data flows. S2S ACK for Edge Processor gives customers greater confidence in production ingestion paths where delivery assurance matters. This capability helps preserve familiar Splunk forwarding reliability patterns by supporting acknowledgement for eligible Splunk-to-Splunk receiver and exporter flows across Edge Processor deployments with a Cloud control plane. With S2S ACK, teams can process, transform, mask, and route data through Edge Processor while maintaining at-least-once delivery expectations for supported paths. Admins also gain visibility into acknowledgement health, latency, pending batches, queue usage, and backpressure, making it easier to validate reliability-sensitive architectures and diagnose whether delivery issues are happening upstream, inside Edge Processor, or downstream. This is an important step for customers adopting Edge Processor in security, compliance, audit, and operational data flows where data loss risk must be minimized. Customers should validate with representative workloads before broad rollout and work with Splunk to confirm eligibility and enablement. To request this Controlled Availability feature to be enabled on your stack, reach out to [email protected]! See the Splunk Platform in Action at .conf26! .conf26 is almost here, and we’re heading to Denver for four days of learning, connection, and hands-on exploration with the Splunk community. Register for .conf26, browse the session catalog, and start planning your time in the Pavilion. We can’t wait to see you in Denver, September 14–17! Your Feedback Matters Reach out to the community Slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. Keep the good stuff coming. Here’s how to subscribe to this blog — and stay in the loop on the topics that matter to you.   ... View more

  Welcome to the July 2026 edition of Data Management Digest! As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. This month brings a strong mix of product updates and hands-on learning: smarter, more efficient aggregations with the enhanced stats  command, new improvements in Ingest Monitoring, the next step in our CrowdStrike integration for Data Inputs, and a fresh batch of videos and demos to help you get more value from your Splunk data pipelines. What’s new in Data Management: Smarter, More Efficient Aggregations with the Enhanced stats command We've enhanced the stats command in Ingest Processor to deliver more accurate and efficient aggregations. By default, aggregations are now calculated over a configurable state window instead of individual data batches, producing fewer, more complete aggregation events while reducing downstream event volume. Existing stats pipelines are automatically upgraded to this new behavior, with aggregations emitted at configurable intervals (30 seconds by default), helping optimize processing and improve data quality without requiring pipeline changes. If aggregate throughput exceeds the supported soft limit of 1 TB per day across all stats pipelines, Ingest Processor automatically falls back to batch-based aggregation to maintain performance. This release also introduces new configuration options, allowing you to customize the state window and control metadata field naming for aggregated data, giving you greater flexibility to tailor aggregations to your environment. Customer benefits: Higher-quality, more complete aggregations Reduced output event volume and downstream processing costs Automatic adoption with no pipeline rewrites required Greater control through configurable aggregation behavior   Ingest Monitoring 1.2.1 includes customer-impactful improvements around flexibility, visibility, and reliability. Customers can now configure the scheduled search window to better align metric computation with their SLAs and optimize SVC usage, while new latency metrics such as min, max, p95, and average provide deeper ingest performance insights. The release also improves metric reliability by reducing skipped searches and includes UI modernization Configurable scheduled search window so customers can tune metric computation frequency to match their SLAs and optimize SVC usage. Expanded latency metrics including min, max, p95, and average for better visibility into ingest performance. Improved metric reliability by shifting search start time to reduce skipped searches. Crowdstrike Integration for Data Inputs – Customer Migration We’re beginning the next phase of the Crowdstrike integration for Data Inputs. This update will help customers move from the existing technical add-on experience to the new Data Inputs app, giving teams a more streamlined and supported way to manage Crowdstrike data collection in Splunk. Our team will begin reaching out to impacted customers shortly with migration guidance and next steps. The goal is to make the transition as straightforward as possible while helping customers take advantage of the improved Data Inputs experience. And now for the good stuff: demos! This month we have a packed lineup of new walkthroughs covering everything from Edge Processor setup and instance tagging to data strategy workshops for routing, redaction, classification, and optimization. Whether you’re looking to reduce ingest volume, clean up noisy fields, or better understand how data flows through your environment, these videos are built to give you practical examples you can put to work right away.   Edge Processor Instance Tagging video Need more visibility into how your Edge Processor deployment is performing? This walkthrough shows how to tag events with the processing instance so you can analyze latency, troubleshoot pipelines, and understand data flow at the instance level. Watch Instance Tagging Video → Data Management Index & Event Optimization (Workshop Edu) This workshop introduces the core data management strategies available in Splunk Cloud Platform, from storage tiers and retention to event processing and data routing. It's a good starting point for anyone designing or reviewing a long-term data strategy. Watch Index & Event Optimization Workshop → Data Strategy Workshop - Credit Card Routing and Redaction See how a single Splunk Ingest Processor pipeline can create multiple versions of the same event for different use cases. The demo covers redaction, routing, and building a lightweight dataset for security analytics while preserving the original data for authorized users. Watch Routing & Redaction Workshop → Data Strategy Workshop - Palo Reduction and Classification Built-in Splunk Ingest Processor templates can do more than reduce event size. This demo shows how to minimize Palo Alto Networks firewall logs while classifying them into the source types expected by Splunk apps and Technology Add-ons. Watch Palo Reduction & Classification Demo → Data Strategy Workshop - Sourcetype Classification for KOs Generic source types can make knowledge objects harder to manage. This walkthrough demonstrates how to classify events at ingest time so calculated fields, field extractions, and other knowledge objects apply only where they belong. Watch Sourcetype Classification Demo → Data Strategy Workshop - Whitespace Removal via Template Empty JSON fields consume storage without adding value. This demo shows how to use the built-in Empty Field Removal template to eliminate nulls and whitespace before events are indexed. Watch Whitespace Removal Demo → Splunk Edge Processor Demo: XML to JSON for Windows Security Logs Learn how to use Splunk Edge Processor to convert Windows Security Event Logs from XML to JSON before they're indexed. By removing XML formatting overhead while preserving the original event data, you can reduce ingest volume and optimize Windows log storage without sacrificing visibility. Watch XML to JSON Conversion Demo → Save Money with Splunk Edge Processor | Cisco ASA Log Filtering Demo Not every firewall event needs to be indexed. This demo routes Cisco ASA logs based on severity, sending high-value events to Splunk while archiving lower-priority logs to Amazon S3. Watch Cisco ASA Filtering Demo → Splunk Edge Processor On-Prem Setup (Part 1): Install the Control Plane The first video in the on-premises deployment series walks through installing and configuring the Splunk Edge Processor control plane, preparing your environment for managed Edge Processor deployments. Watch Control Plane Setup (Part 1) → Splunk Edge Processor On-Prem Setup (Part 2): Deploy Your First Edge Processor With the control plane in place, the next step is deploying your first Splunk Edge Processor. This walkthrough covers registration, pipeline deployment, health validation, and basic troubleshooting. Watch Edge Processor Setup (Part 2) → Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below. Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more

Welcome to the June 2026 edition of Data Management Digest! This month’s update is short and sweet, with a few helpful releases and resources to keep on your radar. Consider this your go-to round up for what’s new across Splunk Data Management, from agent management improvements to expanded support for public sector data operations. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What’s new in Data Management: Data Manager: CrowdStrike integration - Phase 2! The latest phase of the CrowdStrike integration continues to improve how teams manage and operationalize key data sources through Splunk Data Management. These updates are designed to reduce manual effort, simplify setup, and help teams get critical security data flowing into Splunk faster and more reliably. Data Inputs (formerly Data Manager) has reached full ingestion feature parity with the CrowdStrike FDR Technology Add-on, giving CrowdStrike customers the same core capabilities in a more scalable, cloud-native experience. Compared with the TA, Data Inputs is easier to manage, avoids search-head performance impact, scales automatically, and adds built-in monitoring and alerting to make onboarding and operations simpler. See Agent Management Versioned App Retrieval in action Earlier this year, we launched Agent Management Versioned App Retrieval (AMVAR) in Splunkbase. AMVAR automates the transfer of approved application files from external version control systems, such as GitLab, into Agent Management, reducing manual file movement and saving teams time during release workflows. With AMVAR, you can automatically check for new app versions, download and deploy them, and roll back when needed, while maintaining secure connections to your systems. Modernizing Public Sector Data Operations: Introducing Edge and Ingest Processors with SPL2 at FedRAMP Moderate Edge Processor and Ingest Processor are now available for Splunk Cloud Platform FedRAMP Moderate customers in AWS GovCloud (US) regions. This gives public sector teams more control over how data is filtered, masked, transformed, and routed before it is stored or indexed. With SPL2 available across search and pipeline-building experiences, teams can use a consistent language to move between investigating data and shaping data in motion. For agencies managing sensitive but unclassified data, this helps support secure data operations, reduce unnecessary ingest, protect sensitive information, and keep high-value telemetry ready for analytics. Read the full announcement. A quick reminder! Data Manager renamed Data Inputs Splunk is renaming the Splunk Cloud Platform app called Data Manager to Data Inputs. It remains the place to configure and operate cloud and hyperscaler ingestion, and the new name aligns with the work you already perform. Your existing configurations stay the same, so there is no need to rebuild inputs or pipelines because of this rename.   Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below. ... View more

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What’s new in Data Management? Bringing SPL2 processing to FedRAMP Moderate: We're pleased to announce that both Edge Processor and Ingest Processor are now available for Splunk Cloud customers in AWS GovCloud (US). Eligible stacks will be automatically onboarded to the Essentials tier for Ingest Processor. Interested customers should contact their account teams to confirm their stack is onboarded. Stats M1.5 is now available in Ingest Processor, extending the SPL2 stats command with semi-stateful ingest-time aggregations for pipelines of any shape or size. Instead of aggregating only within individual batches, Ingest Processor can now maintain aggregation state across events within a processing instance, giving teams more complete partial summaries before data reaches Splunk indexers. Admins can calculate counts, sums, minimums, and maximums over fields or time windows, with controls such as maxdelay and summary or transparent modes to balance compaction, freshness, and downstream query behavior. This is a step-function improvement in aggregation efficiency, helps reduce noisy telemetry and storage impact while preserving the signals needed for monitoring, threat detection, compliance, and cost-aware analytics. The SPL2 dedup command is now available with semi-stateful support in Edge Processor, giving customers a practical way to reduce duplicate events before they are indexed. Teams can define duplicate logic at the field or whole-event level, preview pipeline output, and drop repeated values from chatty sources such as firewall, debug, network, disaster recovery, or backfill logs. With per-instance dedup efficiency, Edge Processor now offers an even greater arsenal of tools to help you trim noise, improve search efficiency, and reduce unnecessary ingest while preserving Splunk search-time deduplication for final refinement. See AI-Powered Data Management in action! New demo of automated pipeline features, inclusive of Guided Onboarding, Auto Schematization, Automated Field Extraction, and Self-Healing Pipelines. We are using AI to automate data onboarding tasks to the eliminate manual work of setting up and maintain pipelines. See it in Action  Splunk Enterprise 10.4 & Splunk Cloud Platform 10.4 is now live! Splunk Platform 10.4 is a major update centered on unifying data visibility & simplifying operations. Headlining this release is Federated Search, a powerful new capability that lets you search distributed data in place across hybrid and multi-cloud environments, reducing data movement while accelerating access to the insights your teams need most. Features and Enhancements Available in Splunk Platform 10.4 Data Management Consolidation We are excited to introduce the new Data Management home page, a centralized hub that consolidates your critical data management workflows into one intuitive, unified experience. By providing a single entry point for tasks like ingest monitoring, data inputs, and dataset configuration, this update eliminates navigation friction and helps you manage your data ecosystem more effortlessly. Experience a more streamlined and efficient way to organize your work, letting you focus on getting the most value from your data. Edge and Ingest Processors for FedRAMP Moderate FedRAMP Moderate (Impact Level 2) is a U.S. government security authorization that enables federal agencies and public sector organizations to use cloud services for handling sensitive but unclassified data. We are pleased to announce that both Edge Processor and Ingest Processor are now available for Splunk Cloud Platform customers. Edge & Ingest Processor provide the "intelligence layer" in a data pipeline. It is the practice of capturing, filtering, masking, transforming, and routing telemetry in transit, before it ever hits storage or is indexed. In the agentic era, pipelines must understand intent, not just payloads. Customers who use Splunk data processing capabilities can routinely reduce ingest volumes without losing analytical value. That’s a direct hit to your infrastructure costs and a direct boost to search performance. Check out our technical capability deep dive for Edge & Ingest Processor to learn how you can reduce noise and simplify operations. Data Manager renamed Data Inputs Splunk is renaming the Splunk Cloud Platform app called Data Manager to Data Inputs. It remains the place to configure and operate cloud and hyperscaler ingestion, and the new name aligns with the work you already perform. Your existing configurations stay the same, so there is no need to rebuild inputs or pipelines because of this rename. Federal Information Processing Standards Publication #140-3 (FIPS 140-3) support for Edge Processor We are pleased to introduce full FIPS 140-3 support for Edge Processor and Data Management components in Splunk Enterprise, making these capabilities available to customers who need to meet strict encryption requirements. With this update, organizations operating in FIPS-enabled environments can now securely access and use Edge Processor and related data management experiences without sacrificing functionality. This means regulated customers can take advantage of modern data processing workflows while maintaining the security and compliance standards their environments demand. Upgrade Readiness With the announcement of these exciting enhancements and modernizations, the Splunk platform is committed to staying ahead of the ever-evolving digital landscape. To continue the modernization of the Splunk platform, customers might need to take action to prepare for certain breaking changes. Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below.   Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

Welcome to the April 2026 edition of Data Management Digest! As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community.   What’s New in Data Management: AWS Athena with Splunk DB Connect is now Generally Available: Integrating AWS Athena with Splunk DB Connect allows users to query vast Amazon S3 data lakes directly from the Splunk interface using standard SQL. This integration drastically reduces costs by keeping high-volume historical data in S3 while maintaining the ability to correlate it with real-time operational logs. It optimizes performance by processing data at the source, ensuring efficient analysis for both security and operational use cases. The new SC4S Configuration Tool simplifies your syslog management by providing automated validation and simplified deployment workflows. This powerful enhancement significantly reduces manual configuration effort and ensures data integrity, allowing your team to focus on securing your environment with reliable and high-speed data insights. To fully leverage high-volume data sources like Isovalent kernel-level logs, and to provide more robust observability and security insights, the "stats" function is evolving to offer more comprehensive and efficient state management. This includes improving aggregation consistency per processing instance and handling late-arriving events more gracefully. This bridges the gap between basic semi-stateful processing and highly efficient aggregation, reducing data for Splunk customers by: Increased Aggregation Efficiency and Accuracy: Provide more complete and accurate aggregations by maintaining state across events within a single processing instance for Edge Processor. Ensuring Resource Efficiency and Configurability: Provide mechanisms for users to control aggregation time windows while ensuring resource exhaustion is prevented. Data Manager is becoming Data Inputs: early summer 2026, the Splunk Cloud Platform app called Data Manager will be renamed to Data Inputs. It remains the place to configure/operate cloud and hyperscaler ingestion on Splunk Cloud; the new name aligns to the work you already perform. Data Inputs will sit within the broader Data Management experience: Splunk’s umbrella for data-management workflows in the product, so ingestion-related tasks are easier to find in context with the rest of your data-management work. Your existing configurations stay the same; you do not need to rebuild inputs or pipelines due to this rename. Introducing the AI-Powered Self-Healing Pipeline for CIM Compliance Alpha Program: Self-Healing pipelines proactively detects and remediates CIM compliance issues, ensuring your security data remains accurate and reliable. By automating complex troubleshooting and providing intelligent configuration fixes, this feature allows your team to focus on achieving critical security outcomes rather than manual data mapping. We invite you to try the Self-Healing Pipeline today and share your experiences with our team. For more information, reach out to Varun Gupta.     Connect & Engage Cut Costs, Not Capabilities: Ingest Only What You Need with S3 Promote Join our upcoming Community Office Hours on May 21 to learn how S3 Promote helps you bring the right historical data from Amazon S3 into Splunk Cloud on-demand so you can investigate faster, control ingest costs, and keep analytics focused on what matters most. Bring your questions to this AMA to get practical guidance on setup, supported data types, licensing, monitoring, and best practices for getting value from your archived data. Ask your questions here!   Data Management & Federation Bootcamp Series We’re continuing our Data Management & Federation Bootcamp Series with Session 2, focused on how to process, transform and route your data efficiently in Splunk. Sign up for Session 2 on May 6! Topics:  • Overview of Edge Processor, Ingest Processor, and Ingest Actions  • Introduction to SPL2  • Key data processing techniques: routing, filtering, masking, and transformation  • Routing data to S3 and S3 promote workflows  • Using templates to standardize data pipelines If you’re looking to improve data routing, reduce ingestion costs, and get more control over how your data flows into Splunk, this session will be especially useful. Register here for Session 2!AI-Powered Data Management Tech Talk: Now On-Demand You can now watch our recent AI-Powered Data Management Tech Talk on-demand to learn how to transform raw telemetry into real-time intelligence using our latest AI-driven automation. Explore the session recording, see demos in action, and review the comprehensive Q&A to discover how you can streamline your data pipelines and maximize your team’s productivity. Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below. Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

    Welcome to the March 2026 edition of Data Management Digest! As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. AI-Powered Data Management – Data onboarding is about to get a lot easier In the era of agentic AI, your machine data is your most strategic asset, but only if you can avoid getting buried in "data chaos." As data volumes grow, many organizations find themselves hindered by manual processes and fragmented tools. Introducing our new AI-Powered Data Management capabilities to accelerate your data ingest and intelligence. Let’s break them down: Automated Field Extraction (AFE) – Controlled Availability: AFE analyzes your data sources and suggests fields for extraction during data ingestion and processing. You simply select the fields you need, and the AI handles the complex regex logic behind the scenes. See it in action! Guided Onboarding with Auto-Schematization – Alpha: It uses AI to analyze sample data and automatically recommend the most appropriate CIM data models. This ensures your data is instantly ready for CIM-based detections and high-performance analytics without the manual mapping headache. Dive into the details to see how this accelerates CIM‑aligned onboarding while keeping humans in control. Join Our Upcoming Tech Talk on AI-Powered Data Management If you are looking to streamline your data pipelines and reduce operational overhead, join our upcoming Tech Talk: "AI-Powered Data Management" on Thursday, April 23, 2026, from 11:00 AM–12:00 PM PDT. During this session, our Splunk experts will demonstrate how to move beyond manual toil using: Automated field extraction and guided onboarding. Auto-schematization and self-healing pipelines. Strategies to ensure your data is always analytics-ready for your most critical use cases. Don't miss this opportunity to see how AI-driven automation can improve your team’s productivity and help you build a resilient, AI-ready data foundation. Register today!   A Guide to Building a Data Management Strategy Organizations today are inundated with vast volumes of information growing exponentially. By 2028, an estimated 394 zettabytes of data will be generated annually, most of it as machine data. Yikes! Without a clear strategy for how data is collected, stored, transformed, and accessed, organizations risk spiraling costs, compliance failures, and missed data insights. This new guide helps you understand and implement effective data management strategies using the Splunk platform. Dive into: Data management capabilities in the Splunk platform: Learn about the core data management capabilities available in the Splunk platform and the role each plays in an effective data management strategy. How each capability supports data management: See how each capability can be applied to maximize data value while minimizing costs and complexity. Factors to consider when planning your strategy: Understand the key factors to evaluate when designing a strategy that aligns with your business objectives and regulatory requirements. Step-by-step implementation scenarios: Walk through practical scenarios and steps for putting each capability to work. Best practices by capability: Review best practices that apply across each data management capability. Maximizing strategic value and optimizing costs: Explore the strategic and cost benefits a well-implemented data management strategy can deliver. How to put your strategy into practice: Learn how to move from planning to implementation with practical Implement your strategy today!   What’s New in Data Management: Kubernetes-Native Edge Processing now Generally Available: Splunk Edge Processor is now fully containerized and Kubernetes-native, enabling automated, elastic scaling and seamless integration into your existing CI/CD workflows. This update eliminates manual provisioning and operational overhead, allowing your data pipelines to adapt to fluctuating volumes in real time. Gain faster deployment cycles, reduced operational risk, and a more resilient ingest tier that optimizes data before it reaches your indexers. Learn more, here! Demo Promote in Splunk Cloud Platform! Cut costs, not visibility with Promote for S3! See it in action and start saving cost by selectively ingesting historical S3 data. Accelerate threat hunting, improve retrospective detection capabilities, and streamline compliance workflows with ease. Splunk Cloud Platform 10.3 Is Now Generally Available: 10.3 delivers updates across dashboarding, observability, data management, governance, and platform performance. Check out these new features! Announcing the Alpha Preview for Unified Intermediate Forwarding Tier: Modernize your ingest without compromise! This hybrid architecture allows you to preserve your existing ingest logic and configuration without the need for complex SPL2 rewrites, ensuring your data pipelines remain both stable and highly capable. Sign up today via the Voice of the Customer portal.   Continue Your Learning: Data Management and Federation Bootcamp Series Looking to go deeper into data management in Splunk? Join our 4-part Data Management & Federation Bootcamp Series to learn practical strategies for organizing, processing and optimizing your data directly from the Splunk experts who built these tools. The series kicks off with Session 1 on April 8, don’t miss it! Register for the full series here! Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below. Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.   ... View more

  As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected by subscribing to Data Management blogs and announcements in Splunk Community. Turn Data Chaos into AI Clarity: Virtual Summit Register Here to unlock AI innovations with your Data Strategy The AI landscape is evolving at breakneck speed - from generative experiences to autonomous agentic systems that reason, act, and adapt in real-time. This explosion of machine data demands that organizations adopt a new data strategy: one that delivers not only access, but actionable insights, robust data governance, and unmatched agility at petabyte scale, across every domain. Fragmented platforms, siloed machine data, and operational complexity aren't just inefficiencies anymore; they're barriers preventing you from scaling AI with confidence and speed. Join our transformative 3-day virtual summit and discover how Cisco Data Fabric enables you to unify, activate, and operationalize machine data at massive scale. Powered by the Splunk platform, the Cisco Data Fabric is designed to dramatically reduce the cost and complexity while overcoming the challenges of managing vast volumes of distributed data. What's New in Data Management: Ingest-time aggregations via stats in Data Management SPL2 Processing Cloud Products: We are excited to announce the launch of the new ingest-time aggregation capability within both Edge Processor on Cloud (EP) and Ingest Processor (IP). This enhancement allows our Splunk customers to perform partial batch-based aggregations at stream-time using the SPL2 stats command, with final aggregation available at search-time via Splunk Enterprise or Splunk Cloud Platform. Learn more here! Data Manager & CrowdStrike Integration: Splunk’s Data Manager now supports Phase 1 of CrowdStrike integration, enabling streamlined, validated onboarding and management of CrowdStrike data directly from the SCDM UI, reducing setup complexity and improving visibility across deployment and runtime. Static Threshold alerts introduced in Ingest Monitoring: Ingest Monitoring (IM 1.2.0 version) now includes alerts for key data management metrics, plus several other enhancements to improve dashboard load times. Agent Management Versioned App Retrieval in Splunkbase (AMVAR): The AMVAR feature automates the transfer of approved application files from external version control systems like GitLab into Agent Management, eliminating manual file movements and saving customers periodic effort. This solution can save customers hours or even days by simplifying their release processes.   Get Involved with Voice of the Customer: Join the Field Filters Beta Program: Elevate Your Data Privacy: Field Filters allow customers to protect confidential information (PII, PHI, etc.) by redacting, hiding, or hashing specific fields at search-time. This feature gives users a flexible and scalable ability to help meet strict privacy requirements (GDPR, HIPAA, FISMA) without altering the original data at rest.  Utilizing field filters drives ROI for your Splunk investment, allowing you to ingest sensitive data that might have previously been off-limits due to exposure concerns. As of Splunk Cloud Platform 10.0 and Splunk Enterprise 10.2.2, Field Filters are publicly available for use in Beta. If you have been waiting with bated breath to use this feature or have specific use cases in mind that this feature can enable, become an adopter for Field Filters. Your feedback will help pave the way and drive enhancements on the path to GA. Using an earlier version of Splunk? Not a problem! If your release version is on Splunk Cloud 9.1; Splunk Enterprise 9.3, or later, you can still turn on and use Field Filters by following our steps outlined in our  documentation. Announcing Alpha Preview for Edge Processor to function as a full Intermediate Forwarding Tier, reducing the need for a Heavy Forwarder in front of it. The preview introduces full support for Splunk’s index-time line-breaking rules, including multiline merging, regex-based event breaking, and advanced event handling previously available only in Splunkd. It also adds timestamp creation at Edge Processor time using SPL2-based extraction, addressing a major functional gap compared to Heavy Forwarders. The program runs from March 15 to June 16, 2026, and customers can sign up in the Voice of the Customer portal Alpha/Preview sign-up for CIM compliance monitoring in Ingest Monitoring: Are you struggling to keep up with the growing complexity of data sources and ensuring consistent CIM (Common Information Model) compliance? You’re not alone. As organizations expand their use of Splunk, maintaining clean, normalized data across every source is more critical, and more challenging, than ever. Even a single misaligned field can disrupt your premium apps, break dashboards, and leave critical alerts undetected. Splunk’s upcoming CIM Compliance Monitoring feature is here to change the game! No more waiting for dashboards to flag issues after the fact, or enduring endless trial-and-error updates in your Technology Add-Ons. With our new capability, you’ll get: Proactive alerts the moment CIM compliance issues occur Precise identification of which fields need your attention Automatic suggestions for updated regex/configurations to instantly bring your data back into alignment - without disrupting what’s already working And the best part? It’s all delivered natively in Splunk Cloud as part of the Ingest Monitoring app - no custom installs, no hassle. As of now, we’re looking for customers to join our exclusive Alpha program starting late April/early May 2026. Sign-up here! Connect & Engage: Boost Productivity with SPL2: The Next-Gen Language for Splunk: Join us for an in-depth Tech Talk on SPL2, the next-generation language designed to unify data preparation, search, and transformations across the entire Splunk ecosystem. We will explore how SPL2 makes your job easier by reducing the learning curve and providing a consistent experience for data both in-motion and at-rest. This session features a live demonstration of the new SPL2 Search Mode and explores how to leverage SPL2 modules and apps to streamline your investigations. Whether you are building custom solutions or investigating security threats, learn how to turbocharge your use cases with a flexible language that supercharges our original SPL. Register here! Our Comprehensive Guide to SPL2: Navigating New Features and Optimizing Workflow: catch up and listen to our SPL2 Community Office hours recording on-demand. Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community.   What topics would you like us to cover next? Share your thoughts in the comments below. ... View more

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data Management Digest! This monthly series is your go-to resource for the latest Splunk Data Management innovations, key announcements, and community highlights. Our goal is to provide a centralized source of information to help you maximize your Splunk investment and stay ahead of the curve. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What's New in Data Management: General Availability of Promote in Splunk Cloud Platform: Starting with support for Amazon S3, Promote empowers users to ingest historical data from S3 buckets into Splunk Cloud on demand through a simple, wizard-driven UI. Whether you are conducting a retrospective threat investigation or a compliance audit, Promote provides the flexibility to move data from your data lake into Splunk for deep, iterative analysis. This capability complements Federated Search, giving you the power to choose between searching data in place or indexing it when high-performance investigation is required. General Availability of the Splunk OpenTelemetry Collector for Kafka (SOC4Kafka) This modern, OpenTelemetry-native solution replaces legacy Kafka connectors, providing a scalable way to ingest, monitor, and analyze Kafka data within the Splunk Platform. SOC4Kafka subscribes directly to Kafka topics to capture message payloads and metadata, utilizing OTel processors to enrich, batch, and filter data before streaming it to the Splunk HTTP Event Collector (HEC). This ensures your data is clean and structured for real-time analysis, giving your teams deep visibility into data pipelines to detect anomalies earlier and reduce MTTR. SPL2 Stats Command in Edge & Ingest Processor for Splunk Cloud Platform: The new SPL2 Stats Command empowers customers to dramatically reduce data volumes, and associated costs, by enabling partial batch-based aggregations and summarizations of log data before it reaches Splunk indexers. This means organizations can efficiently capture the insights they need for monitoring, threat detection, and compliance, while minimizing storage and licensing impact, especially valuable for high-volume use cases like Isovalent Runtime Security. Edge Processor and Ingest Processor are now regionally available for Splunk Cloud Platform customers in Brazil and Indonesia, enabling enhanced data filtering, masking, and routing close to the source or at ingest with cloud-managed infrastructure. Get started by configuring your Edge Processor nodes or activating Ingest Processor through your Splunk Cloud Platform instance. Splunk Enterprise 10.2 and Splunk Cloud Platform 10.2: The General Availability of Splunk 10.2 and Splunk Cloud Platform 10.2 was announced, delivering our next generation data search and preparation language, SPL2, and enhancements across cloud and enterprise environments for improved efficiency, cost savings, and security. To help you optimize your data strategy, we are spotlighting the following key Data Management innovations now available in Splunk Enterprise 10.2: Agent Manager Enhancements: The latest Agent Management enhancements provide Splunk Enterprise admins with a streamlined experience, featuring improved navigation for easy switching between Forwarders and OTel Collectors, enhanced UI workflows, performance optimizations, and comprehensive fleet overviews. This unified management interface enables admins to efficiently manage, maintain, and troubleshoot all their agents from a single, centralized location—simplifying operations and reducing complexity across their infrastructure. Edge Processor Enhancement: With the latest Edge Processor enhancements, customers gain real-time visibility into pipeline status updates and health metrics, making it easier to monitor and manage data flows efficiently. The addition of AWS S3 Parquet support and Multi Event JSON Ingestion increases flexibility and standardize processes, empowering users to adapt to evolving data needs and gain deeper clarity over their infrastructure. To learn more about the new enhancements in Splunk Enterprise 10.2, see our documentation. Your Feedback Matters: Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What data management challenges are you tackling in February? We’d love to hear your thoughts on these updates or any topics you'd like us to spotlight in future posts. Join the conversation below! Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.   ... View more

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the Splunk Data Management team is pleased to bring you the December edition of our monthly digest, reflecting our ongoing commitment to elevating your data management capabilities. As your trusted partner in data innovation, we are dedicated to evolving Splunk’s Data Management offerings, and this series serves as your essential guide to these advancements. Each month, you'll discover a comprehensive roundup of announcements, exciting new capabilities, valuable community insights, and key event highlights, all showcasing the dynamic world of Splunk Data Management. Our mission remains to provide a singular, indispensable resource for all your data management news, empowering you to maximize your Splunk investment and stay at the forefront of innovation. Consider this your go-to resource for everything happening in the world of Splunk Data Management! Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What's New in Data Management: New SPL2 pipeline templates for Splunk Edge Processor and Ingest Processor, designed to accelerate data processing through out-of-the-box logic for data transformation, volume reduction, and logs-to-metrics conversion. These templates help users quickly deploy pipelines for common data sources, saving storage costs and ensuring compatibility with existing Splunk solutions. Learn more about this new batch of SPL2 pipeline templates here. Announcing the Beta program for Agent management integration with GitHub, GitLab, JFrog, and Nexus: The new Agent Management Versioned App Retrieval beta is now available via Splunkbase, enabling streamlined version control and automated app transfers between Agent management and your preferred CI/CD or artifact repositories. This integration allows you to centrally manage deployment apps, automate releases, and quickly roll back changes when needed with simplified setup and enhanced change management. Interested customers can join the beta and share feedback through the Voice of Customer portal. Learn more and participate in the beta here. Happy testing!  Connect & Engage: Data Management & Federation Community Office Hour: Watch the on-demand replay of our November Community Office Hours covering new innovations in the Splunk Data Management space and how to optimize Edge and Ingest Processor to maximize your data value. Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below. ... View more

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the Splunk Data Management team is committed to continuously enhancing your experience. Our team is working to constantly build and evolve Splunk’s Data Management offerings, and we're excited to launch this new monthly blog series to showcase these innovations. Each month, you can expect a comprehensive roundup of all the key announcements, exciting new capabilities, valuable community content, and event highlights showcasing Splunk Data Management. Our goal is to provide a single, easy-to-access source for all your data management news, helping you maximize your Splunk investment and stay ahead of the curve. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What's New in Data Management: Edge Processor for Splunk Enterprise: Bring data management closer to your premises with the introduction of Edge Processor for Splunk Enterprise. Read about it here:  Expanded Data Management with Ingest Monitoring: Gain native visibility across all your data sources in Splunk Cloud Platform with new ingest monitoring capabilities. Learn more here: Splunk expands Data Management capabilities to include ingest monitoring Streamlined Agent Management: Managing deployments at scale just got easier with Splunk's expanded agent management features. Discover the evolution here: Splunk expands Data Management capabilities to include agent management Relive the Magic of .conf25! Earlier in September, we gathered in Boston for our annual user conference, .conf25, and it was an incredible event! If you couldn't make it, or just want to revisit your favorite sessions, you're in luck: .conf Online is officially LIVE! You can now catch all our technical sessions, panel discussions, and theater session slides directly from our website – no login required! Head over to conf.splunk.com/watch/conf-online.html to access the full library. Essential .conf25 data management sessions curated by our experts: Strategic Data Mastery: Optimize Storage, Cut Costs, and Drive Insights with Paul Davies and Tolga Tohumcu, Splunk. Craft powerful data strategies, optimize storage solutions, and effectively manage costs. Gain insights to enhance analytics capabilities and drive informed decision-making. Whether you're looking to streamline operations or boost strategic outcomes, this session equips you with the tools to transform data challenges into opportunities for growth and innovation. Make Your Data Lean and Meaningful Using Splunk Edge Processor with Michael Labbe, Hyatt Hotels. discuss how to filter, route, and transform your data at the edge — before it impacts your license. This solution features a user-friendly UI that eliminates the need for complex backend configuration files. With SPL2, you can now write simple code that significantly affects the size, path, and usability of your data — helping you save on storage costs and reduce the overall workload impact in your environment. Get MORE data in. Optimize Data Ingest: Practical Tips to Maximize Splunk's Value with Brett Adams, Deloitte. Splunk can easily ingest machine data and make it useful, yet less than half of the bytes you ingest are actually meaningful. This session covers practical examples for data optimization across multiple professional services, as well as how to write ideal application logs that won't waste space. Regeneron, an Ingest Processor: Data Transformation Success Story with Nick Zambo, Splunk, and Raies Uddin, Regeneron. Discover how Regeneron leverages Splunk's Ingest Processor to streamline data optimization on a variety of data sources. Learn how Regeneron has doubled verbose feeds, tripled scheduled searches, all while maintaining storage efficiency - retain only essential information, normalize key fields, and enrich data when needed. Gain Comprehensive Visibility and Optimize Costs with Splunk Data Management and Federation with Shalabh Goyal, Splunk. Struggling to balance 360-degree visibility with cost? In this session, learn how to use Splunk’s AI-powered data platform (Edge Processor and Federated Search) to reduce storage costs without sacrificing insight. Data Manager: Seamless Onboarding Comes to Splunk Enterprise with Katrzyna Szulc, Splunk. Are you managing Splunk Enterprise and tired of manual data onboarding? Learn how we bring Splunk Data Manager to Splunk Enterprise, easing setup with wizard-driven installation, IAM role guidance, and validation tools. We'll share best practices to reduce errors, cut deployment time, and ensure data reliability.  Rewind, Replay, and Secure: Amazon S3 Replay in Splunk Data Manager with Varun Gupta, Splunk. Need to analyze historical data for security or compliance? Learn how to use Amazon S3 Replay in Splunk Data Manager to selectively pull data into Splunk for investigations and audits, no external tools required. Panel: Reducing Grunt Work with the power of AI in Data Management and Federation with our Splunk experts. With all the fuss about AI, what’s in it for data management and federation? Come hear what Splunk experts see as AI’s impacts on data management and federation — automating data integration, enhancing data quality, and optimizing distributed systems. AI-driven tools enable real-time data processing and seamless interoperability across federated databases. Connect & Engage: See you at AWS re:Invent! Register and visit Splunk and Cisco in booth 1320 to learn more about our latest Observability, Security, AI and AWS offerings – and of course to get your newest favorite t-shirt! Read our new Whitepaper with IDC: From Data Management to Machine Data Fabric: Laying a Data Platform Foundation to Balance Resilience, Optimization, and Machine Data Readiness, which explores how a purpose-built machine data fabric can help organizations gain a competitive advantage by turning raw operational data into insights and improving security postures. Join industry experts from Splunk and IDC in our on-demand webinar, “In Pursuit of Value: The New Rules of Data Management in the AI Era,” to understand how to shift your data strategy to emphasize quality and accessibility amidst exploding data volumes and AI-accelerated innovation. Splunk 10 Tech Talk On-Demand: Smarter, Faster, More Powerful! Watch the on-demand replay of our Tech Talk webinar: "Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever." This session provided an exclusive first look at the next evolution of Splunk Enterprise and Splunk Cloud Platform, detailing powerful new features designed to enhance data security and deliver unparalleled value. November Data Management & Federation Community Office Hour: Watch the on-demand replay of our November Community Office Hours covering new innovations in the Splunk Data Management space and how to optimize Edge and Ingest Processor to maximize your data value. Upcoming Splunk 10 Community Office Hours: Have questions about the upgrade process? Need expert guidance on breaking changes or upgrade readiness? This interactive session is your chance to connect with Splunk professionals and fellow community members to discuss all facets of Splunk 10. EMEA Community Office Hours: Tuesday, December 2, 2025 | 4PM–5PM CEST APJC Community Office Hours: Friday, December 5, 2025 | 9AM–10AM JST AMER Community Office Hours : Thursday, December 11, 2025 | 1PM–2PM PT Your Feedback Matters Reach out to the community slack channel #dm-pipeline-builders with questions for our experts. Stay connected with all things data management by subscribing to Data Management blogs and announcements in Splunk Community. What topics would you like us to cover next? Share your thoughts in the comments below.   ... View more

Hello Splunk Community! We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 this October 2025! This release is packed with innovations designed to enhance your observability, strengthen security, streamline administration, and supercharge your dashboarding experience. At Splunk, we're continuously working to deliver features that directly address your needs and empower you to get the most out of your data. Let's dive into some of the key highlights: Enhanced Security & Streamlined Administration GDPR Compliance with Field Filters: Limit access to PII/PHI data to meet GDPR requirements. Improved Audit Log Format: A better, more structured audit log format, a top customer demand. Unified Identity Interface: Simplifies admin workflows, offering enhanced control and visibility over your Splunk and Observability environment, including Centralized RBAC. Splunk Secret Management: Admins can now limit clear text password exposure. OpenTelemetry & Secure Authentication: Benefit from expanded OpenTelemetry functionality and secure third-party app authentication via OAuth 2.0. Powerful Dashboard Studio Enhancements Custom Visualizations: Seamlessly use existing custom visualizations directly within Dashboard Studio. Observability Metrics & APM Workflows: Leverage metric-based charts and application service map views, and integrate Business Workflows from Splunk APM into your dashboards. Dynamic Panel Visibility: Specify conditions for panel visibility and expressions for token evaluation, making dashboards more interactive. AI Assistant for SPL (SAIA) in Search & Reporting We're excited to announce that the Splunk AI Assistant for SPL (SAIA) is now integrated directly into the Search & Reporting app! This powerful assistant helps users generate, explain, and translate SPL using natural language, significantly boosting your productivity and making SPL more accessible.   You can see the AI Assistant for SPL has been integrated directly into the Search & Reporting app to be even more tightly integrated with existing workflows!   The assistant can be launched by clicking on the SAIA icon in the top right corner.   In this example, SAIA has helped the user write SPL to find what data is being collected in their environment. You can then copy the query into the Search bar and execute. To learn more about the AI Assistant in Search and how to leverage it, please see our Splunk docs pages. What's Next? Splunk Cloud Platform 10.1.2507 empowers you with greater control, deeper insights, and a more secure and efficient operational experience. We encourage you to explore these new features! For more detailed information, please refer to the official Release Notes. Happy Splunking! ... View more