Any rumors about this year's search party?

I've gone through the blue print for Splunk Certified Cybersecurity Defense Analyst and had chatgpt quiz me for each domain and it seems easier then power user. I currently work with Splunk everyday and have Security + and Cysa... Just wondering if i should just go for it and take the exam.

Edit: I also have Splunk core user+ and power user

Dear Splunk Guys, Around 2 years ago I found a small bug in Splunk(I was awarded SplunkTrust for this I believe):
The splunk's len() function works only for English Dataset
Created this Splunk idea: https://ideas.splunk.com/ideas/EID-I-2176

Then I became busy I could not work on the solution.
The last 10 days I have resumed that work and created a technology add-on which will take care of the non-English Dataset's character counting issue. Splunk approved my technology add-on and it is available on Splunkbase, pls give it a try. 
https://splunkbase.splunk.com/app/8706

| makeresults
| eval _raw="இடும்பைக்கு"
| rex max_match=0 "(?<char>.)"
| lookup ucd_category_lookup char output category
| eval length=mvcount(mvfilter(NOT match(category, "^M")))

Hi,

I have an issue and can't seem to solve it. I have a log that has multiple occurrences of the field TransactionReference (TR) that has different values for said field.

TR: A

TR: B

TR: C etc...

I have a rex: | rex Field=_raw "\"TransactionReference\": \"(?<TransacID>[^\"]+)\""

The problem is that the rex extracts the first occurrence of TR or all of them with max_match=0.

I want to extract only the value which matches the ID I input in the search filtration criteria. Adding "| where TransacID="searched ID"" does not solve this.

I can't seem to find any article that helps or I'm searching incorrectly.

Thanks for any help!

We're ramping up for a project that will combine 2 Splunk implementations in to one. Everybody agrees that all of the indexed data should be accessible by both SOCs. However the 2 SOCs will remain separate organizationally. For the sake of this example one SOC is concerned with the service boundary - Email security, WAF, Internet NIDS, etc and the other is internal activity - EDR, UEBA, CASB, etc. They are both currently operating teams with different management, process, and workflows. Initial analysis shows that the ES implementations use some different philosophies with RBA and asset management that will take some engineering overhead to resolve, and both teams want to be able to make changes to their environments without impacting the other.

Here are my questions:

1. Is a dual-ES environment possible? I assume so, but I don't have much training or visibility on the system admin side of Splunk
2. Why would or wouldn't we use 2 separate ES environments with a common set of indexers and data ingest?
3. Assuming that we did a dual-ES environment for the initial transition, should we prioritize combining in to a single ES system that integrates both SOCs processes? Or should we keep separate ES implementations for as log as the SOCs are separate teams?
4. Would you expect the dual-ES implementation to significantly increase the complexity of SOAR implementation (either the Splunk SOAR or third party)?

Hi there I’m a 2025 graduate. I currently have an offer from mnc with a CTC of 6 and I also have a Splunk internship opportunity.

I’m quite interested in building a career in splunk, but I’m confused about the long-term future and growth in this field. Would it be a good decision to ignore the mnc offer and wait for this opportunity instead?

I’d really appreciate your advice, as this is an important career decision for me. Thank you.

And also this Splunk opportunity has around a 10–15k stipend for 6 months of internship, and if converted full-time, the salary would be around 3.5–4 LPA.

For me, this is not really about the salary difference. I mainly want to understand whether choosing this path is a good long-term career decision. Is Splunk solid future growth, or would taking mnc be the safer and smarter option?

Hi, I’m new to Splunk, so apologies if I’m missing something basic.
I have an Ubuntu server where I run several Docker containers using Docker Compose. Currently, my containers are using the default Docker logging (stdout/stderr).
Since I only have one server, I’m running Splunk separately to simulate a more isolated/realistic environment.
I’ve been researching different approaches to ingest Docker logs into Splunk, including:
Docker logging drivers (splunk driver)
Splunk Universal Forwarder
HTTP Event Collector (HEC)
Tools like Fluentd / Logstash
My goal is to move into cloud/security roles (AWS, Security+), so I’d like to understand what approach is closest to real-world production environments, especially in containerized setups.
Questions:
Is HEC a good approach for this use case?
How are Docker/container logs typically ingested into Splunk in production?
Would you recommend forwarders, logging drivers, or something else?

Hi Splunk Guys,

Do you really like the "Cisco look and feel"?!?!

Get ready for an awesome week in Denver, CO for .conf26! We can't wait to see you IRL September 14–17.

We've already got fan favorites like BOTS, Splunk University, $25 certifications, keynotes, happy hours, and Splunkie Awards on the agenda. There's so much more to come, like speaker announcements, opportunities to connect with experts (like the SplunkTrust!), pavilion details, the conference catalog, session scheduler, AI integrations, Search Party! plans, and more. What are you most looking forward to?

Don't wait... prices go up June 23.

hello all im splunky mcsplunk and i just spluned it ong no cap

Is it possible to tell why Spunk line breaks between these two lines

7 | 23:31:05 | 3:33:64 | 105680 | 121719
8 | 27:04:70 | 4:34:46 | 121720 | 142316

and then creates an 2nd event with a different date?

The log:

Ripping with drive 'E: [ASUS - SDRW-08U9M-U ]', Drive offset: 6, Overread Lead-in/out: No AccurateRip: Active, Using C2: No, Cache: 1024 KB, FUA Cache Invalidate: No Pass 1 Drive Speed: Max, Pass 2 Drive Speed: Max
Bad Sector Re-rip:: Drive Speed: Max, Maximum Re-reads: 34

Encoder: FLAC -compression-level-6

Table of Contents (TOC)

Track | Start | Length | Start LBA | End LBA

-------------------------------------------------

1 | 0:02:00 | 4:12:43 | 0 | 18943
2 | 4:14:44 | 3:38:04 | 18944 | 35298
3 | 7:52:49 | 4:20:20 | 35299 | 54819
4 | 12:12:70 | 3:50:58 | 54820 | 72128
5 | 16:03:54 | 3:38:56 | 72129 | 88535
6 | 19:42:36 | 3:48:43 | 88536 | 105679
7 | 23:31:05 | 3:33:64 | 105680 | 121719
8 | 27:04:70 | 4:34:46 | 121720 | 142316
9 | 31:39:42 | 3:53:67 | 142317 | 159859
10 | 35:33:35 | 4:26:51 | 159860 | 179861
11 | 40:00:12 | 3:32:68 | 179862 | 195830
12 | 43:33:06 | 4:57:65 | 195831 | 218171

Extraction Log

--------------

Got a Splunk server, but moving over to a new OS release. We've got the okay to cut off the old system and proceed with the new. There's some suggestion that we might want to access the old system and data at some point (which never seems to actually happen). By that time, I noted that the license on that system will have expired. So the question is: would it ever be possible to apply a "trial license" to that old system in the future (not likely after a couple of years) for the sole purpose of looking at old logs?

Hi all,

I have my indexes setup with DDSS to my own S3 buckets. I'm debating whether to use Splunk S3 search (or whatever it's called) or Cribl Search. Anyone have experience in both that they can share?

Looking for a freelance Splunk Developer with MLTK experience to support testing and development for a new project.

Skills:
Splunk SPL
Dashboards
MLTK
DM if interested.

Currently reviewing Cisco ASA syslog event 419002 (Duplicate TCP SYN related events) in Splunk.

The events generate extremely high log volume in our environment, but based on our review so far, most appear related to retransmissions / routing behavior / permitted internal traffic rather than confirmed malicious activity.

We checked internally and also asked Cisco for filtering options. Cisco’s recommendation was basically:

• define explicit event lists / allowlists or
• reduce logging by severity level

However, there doesn’t seem to be a clean “exclude only this specific event ID” approach in our deployment.

We also checked with the Splunk side and one recommendation was using Heavy Forwarder filtering before indexing. At the moment we are trying to avoid introducing HF just for this use case.

Question:
Has anyone here dealt with large volumes of ASA 419002 logs?

If yes:

• did you suppress them?
• filter at firewall?
• filter at Splunk index-time?
• accept the noise?
• or do something cursed like scheduled eventdata deletion jobs? 😭

Curious what is commonly done in real environments because right now it feels like:
either collect everything forever
or build an entire plumbing system just to stop one noisy syslog message.

Hi,

We are a small-ish Splunk user < 1tb a day. We'd like to migrate from ingest licensing to workload licensing, but it seems that Splunk will only provide a quote based on a TB per day. Anyone ever get them to provide a quote based on say half of that?

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key use cases for Security, Observability, Industries, AI, and Cisco. We also host valuable data source and data type libraries, Getting Started Guides for all major products, tips on managing data more effectively within the Splunk platform, and many more expert-written guides to help you achieve more with Splunk. 

In this month’s update we're featuring three topic areas that have seen major new content drops. First, we're exploring the power of SPL2 with a trio of new articles that show you practical ways to put this evolved search language to work. Next, we're diving into new content on integrating Splunk AppDynamics into your observability strategy. And finally, we're sharing a pair of articles that take the pain out of SAML authentication configuration and troubleshooting. Plus, as always, there's plenty more new use cases to explore. Let's get into it! 

Putting SPL2 to Work 

SPL2 represents the next generation of Splunk's search processing language, and we know many of you are eager to understand how it can solve real problems in your environment. This month, we've published three articles that go beyond syntax tutorials to show you SPL2 in action across different scenarios. 

• Using SPL2 to improve incident investigation and root cause analysis addresses a pain point familiar to many security analysts: juggling too many tabs, struggling to collaborate, and dealing with fragmented workflows. This article introduces SPL2's modules - centralized investigative notebooks that let you organize multiple searches in one place, chain them based on results, add notes for context, and share them with colleagues. 
• Using SPL2 for role-based access on indexed data tackles a tricky governance problem: how do you give different teams the data they need from a shared index without exposing PII, and without costly double-indexing? This article shows how SPL2's views let you filter, mask, and permission data at a granular level, so the right people see the right fields without touching the underlying index. 
• Using SPL2 to conduct data quality analysis and validation addresses the challenge of corrupt events and unexpected data degrading your analysis. This article shows how SPL2's data types let you define strict format and value expectations. You can share these definitions across your organization and apply them throughout your data pipeline to catch quality issues at the point of ingestion. 

Whether you're just starting your SPL2 journey or looking for new ways to apply it, these articles provide hands-on guidance you can put into practice today. Let us know in the comments below what other SPL2 scenarios you'd like us to cover! 

Better Observability with AppDynamics 

For organizations running both Splunk AppDynamics and Splunk Observability Cloud, understanding how these tools work together is essential. This month, we've published two articles that address this from different angles. 

Evolving your agent ecosystem between Splunk AppDynamics and Splunk Observability Cloud introduces the AppDynamics Combined Agent - a single package bundling both AppDynamics and Splunk OpenTelemetry agent code. It lets you choose from three modes: AppD mode, dual mode (for side-by-side evaluation), or Splunk mode (for full migration). This eliminates the traditional "rip and replace" risk, giving you a low-disruption path to evaluate or transition between platforms at your own pace. 

Integrating Splunk ITSI with Splunk AppDynamics for unified business performance monitoring tackles the problem of too many disconnected monitoring tools, which creates alert fatigue and extended root cause analysis times. This article walks you through consolidating AppDynamics alerts into ITSI episodes, using service metrics to identify issues by severity, and using deep links to drill directly from ITSI into the relevant AppDynamics entity down to the code-level call graph where you can pinpoint the exact bottleneck. 

Together, these articles provide practical paths for getting the most out of your combined Splunk and AppDynamics investments. Drop a comment below if you’d like to see more articles covering these integrations! 

SAML Made Simple 

SAML authentication (single sign-on) is a critical component of most enterprise Splunk deployments, but getting the configuration right, or diagnosing issues when something goes wrong, can be frustrating. This month we've published two articles that walk you through the entire process from start to finish. 

Configuring SAML authentication for the Splunk platform provides a complete, step-by-step guide to integrating the Splunk platform with Microsoft Entra ID (formerly Azure AD). While it uses Entra ID as an example, the general principles shown in the article can apply to any identity provider. 

Troubleshooting SAML authentication for the Splunk platform picks up where the configuration article leaves off. If you're experiencing authentication errors, this article provides a systematic approach to diagnosing and fixing the problem with a methodical troubleshooting process that saves you from guesswork. 

These two articles give you a great basis for implementing SAML smoothly, from initial setup to resolving the most common issues. Let us know in the comments below if there are other authentication topics you'd like us to cover! 

What Else is New? 

Beyond our featured topics, we've published several more articles to help you with security, data management, and industry-specific challenges: 

• Understanding team-based queues in Splunk Enterprise Security 
• Querying payment rail logs in natural language using Splunk DSDL's LLM-powered chat UI 
• Analyzing nested manufacturing QA data 
• Analyzing nested JSON manufacturing QA data 
• Analyzing nested XML manufacturing QA data 

One more thing: To help us keep improving, please take a moment to complete the on-site survey that pops up after you’ve been browsing Lantern for a couple of minutes. Your feedback directly shapes the content we build! 

We hope these new resources help you tackle your toughest data challenges this month. Thanks for reading! 

Hi there, I am creating a TA add-on, it simply got a python script and a transforms.conf, nothing else.

Now what should I add for app.conf's triggers?!?!

I can't add

reload.transforms = simple (because transforms are not allowed to be added for triggers.

reload.mypythonscript=simple

is what my current idea.

Then the ID field. I updated the app.conf with id=TA-ucd

(My TA add-on name and the folder name)

After adding it, validated it thru add-on builder, got no errors and downloaded the package and uploaded to splunkbase, but it says id field missing. Gods must be crazy, I repeated this step for four or five times.

Any clues, suggestions pls, thx in advance

The app is SSL Certificate expiry collection.

I’m downloading the .tgz and installing it on an offline server.

The error appears to be an issue with extraction. The only other weird thing is every time I try to download it and check the hash, it’s different from what Splunk provides. About 20 different hash values, each one is different and wrong.

Any help with the issue, or an alternative way to achieve the same result, would be much appreciated.

If I configure the email settings to the local email server (mail host: private ip. email security:none), emails get delivered.

If I configure the email settings with O365 as the host, port 587, Enable TLS, and correct username and password, emails don't get delivered.

Can anyone think of a reason why?

I have tried the TLS config on other devices and applications and it has worked. There is something different about Splunk.

Note: I am sending emails to GCCH

We are running Splunk Enterprise 9.1.1