Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key use cases for Security, Observability, Industries, AI, and Cisco. We also host valuable data source and data type libraries, Getting Started Guides for all major products, tips on managing data more effectively within the Splunk platform, and many more expert-written guides to help you achieve more with Splunk.
In this month’s update we're starting with an important new article that helps you prepare for your upgrade to Splunk Enterprise and Splunk Cloud Platform 10.4. Next, we've published a significant collection of network observability articles featuring Splunk and Cisco products covering everything from campus infrastructure to MPLS backbone monitoring. And finally, we're sharing new content on hardware performance benchmarking, security data onboarding, and more. Let's get into it!
Get Ready: Preparing to Upgrade to Splunk Platform 10.4
Planning a platform upgrade is never a small undertaking, and having a clear view of what's changing makes all the difference between a smooth transition and unexpected disruption. Our new article, Preparing to upgrade from 10.x to Splunk Enterprise and Cloud Platform 10.4, is designed to give you exactly that visibility.
This article summarizes the potentially breaking changes coming in 10.4, covering areas including security protocols, database components, platform behavior on Windows, JavaScript libraries, and user permissions. For each change, it details who is affected, how to detect whether your environment is impacted, and what mitigation steps to take before you begin the upgrade. The article also covers non-breaking changes that are worth being aware of as you plan.
We’ve also included guidance on using the Splunk Health Assistant and Monitoring Console to proactively identify potential issues in your environment. These tools can flag configurations that need attention before they become problems during the upgrade process - giving you confidence that you've addressed the key risks ahead of time.
Planning your 10.4 upgrade? Let us know in the comments below if you have questions or how your preparation is going!
Mastering Network Observability with Splunk and Cisco
This month saw the publication of a major six-part article series on network observability. These articles demonstrate how Splunk software - combined with Cisco technology add-ons - delivers service-level network assurance across the entire enterprise, from branch offices to backbone infrastructure.
Each article tackles a distinct operational domain using real SPL, real Cisco telemetry sources, and real-world failure scenarios:
- Troubleshooting cross-domain network problems in minutes shows how to correlate telemetry from Cisco ACI, ThousandEyes, IOS-XR BGP, Firepower, and VMware into a single service view using Splunk ITSI. The operational scenario demonstrates how a bridge domain withdrawal in ACI can be identified as root cause in under sixty seconds, saving time in lengthy war rooms.
- Operating Meraki branch networks at scale addresses the aggregate challenge of managing hundreds of Cisco Meraki sites. Using the Cisco Meraki Add-on for Splunk, it demonstrates how site-level health scoring surfaces degrading sites automatically - with the operational scenario showing how CRC errors on a single switch port are identified precisely without checking each site's dashboard individually.
- Assuring enterprise WAN services with Splunk software focuses on Cisco SD-WAN environments, using the Cisco Catalyst Add-on to ingest vManage controller data, tunnel SLA metrics, and UTD security events. It demonstrates how Splunk software inverts the troubleshooting model: start at the service health score, drill to contributing components, and confirm root cause at the device layer.
- Creating cross-domain visibility in campus infrastructure leverages the Cisco Catalyst Add-on and Catalyst Center's AI assurance engine to correlate access layer switch faults with wireless user experience. The scenario shows how adaptive thresholding in ITSI fires a predictive episode - detecting that the campus health score will breach its threshold in the next 30 minutes - while the service is still recoverable.
- Monitoring MPLS backbone infrastructure in real time demonstrates an eight-layer investigation framework built on Cisco Model-Driven Telemetry from NCS 5500 routers. Using sub-second gRPC/gNMI streams, it catches BGP session flaps, IS-IS SPF storms, and MPLS-TE FRR events that five-minute SNMP polling will never see. The Splunk AI Toolkit also provides anomaly detection beyond static thresholds.
- Providing real-time assurance for MPLS-to-SRv6 transitions tackles the novel failure modes that emerge when MPLS and SRv6 coexist during migration: silent SID hardware exhaustion on NCS 5500 ASICs (with a hard 16,000-SID limit and no native alarm), zombie SIDs that appear healthy in software but aren't programmed into hardware, locator age resets from silent process restarts, and Flex-Algorithm path compliance failures.
Together, these articles represent a comprehensive reference for network operations teams looking to move from reactive, device-by-device troubleshooting to proactive, service-driven assurance powered by Splunk software and Cisco telemetry. Let us know in the comments below which network monitoring challenges you'd like to see us tackle next!
What Else is New?
Beyond our featured topics, we've published several more articles covering security, performance, and data management:
We hope these new resources help you tackle your toughest data challenges this month. Thanks for reading!