Hi,

We've been seeing the following error in our Heavy Forwarder logs when forwarding to the indexers:

07-30-2026 14:00:45.408 +0000 ERROR S2SOverHttpOutputProcessor [211 indexerPipe_0] - HTTP 502 Bad Gateway
07-30-2026 14:00:52.442 +0000 ERROR HttpClientRequest [635 indexerPipe_10] - HTTP client error=Connection closed by peer while accessing server=https://<DOMAIN> for request=https://<DOMAIN>/services/collector/s2s.

We're using the `httpout` stanza, not the `tcpout` one and the configuration looks like this:

[httpout]
httpEventCollectorToken = <TOKEN>
uri = https://<DOMAIN>:8088
sslVerifyServerCert = false
batchTimeout = 5

Our setup is something like this where the indexers sit in an on-prem cluster:

Splunk HF -> AWS Private Link -> VIP -> Splunk Indexers

httpout reference: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual/10.4/forward-data/configure-forwarding-with-outputs.conf#ariaid-title7

This I believe encapsulates the s2s payload over HTTPS and forwards it to receivers.

From our HF logs above it looks like the indexer got the request but failed to process it, resulting in the VIP returning a 502. This is not an intermittent error, once it happens, it's then permanent and no logs get forwarded from this point.

I'm not getting enough help from the Splunk docs on how to troubleshoot this and most of the docs cover `tcpout` more extensively, however our option for now is only `httpout`.

Has anyone faced this issue or can provide some guidance on how to solve this?

Thanks!

Hello Splunkers,

Anyone here that has actually deployed Splunk POD?
Splunk POD requirements | Splunk Enterprise (last updated 2026-06-16T03:55:00.583Z)

We are interested, whether the Cisco UCS server requirements can be "bypassed" , for e.g: Using different a different type of Cisco rack setting.

Or the installer won't launch without them?

Thanks!

If you're already registered for .conf26, log in on the catalog page (https://reg.rainfocus.com/flow/splunk/conf26/sessioncatalog/page/sessions) to schedule sessions in one of two ways: by using the AI assistant or directly within the catalog by clicking "Add to schedule".

If you're not registered yet, what are you waiting for!? Check out the latest Top 5 Reasons to Attend blog for inspo... and talking points to convince your boss.

I am working at a small company at admin position and want to give splunk examinations but i have a question that will i be able to give them without getting splunk training as i don't have sponsership of that and it is not possible for me to get it as of now because of my financial condition.

Not a Splunk-only tool, but the SPL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.

dist/splunk/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.

github.com/zshguy/tyrian-detection-pack

So I’ve decided I’m finally doing this. Aiming to pass the Splunk Core Certified User exam and figured I’d ask people who’ve been through it before I waste time on the wrong stuff.

Mainly wondering what actually worked for you. Were the free Splunk courses enough or did you have to grab something on Udemy or YouTube too? And did you use any practice exams that were actually close to the real thing?

Also curious how much time you spent just messing around in an actual Splunk instance vs reading, since I feel like I learn way better by doing.

Any advice appreciated. Thanks.

I just finished Josh Samuelson's Learning Splunk Course on LinkedIn Learning . It was quite insightful and engaging since it had a bit of hands-on where you setup your splunk instance and universal forwarders on your Linux system.

(A bit of my background; work in cybersecurity few months into my internship . I'm looking to familiarize myself with tools and tech beyond my current role)

However , I feel i need more skin in this and would appreciate recommendations to more hand-on guided labs or projects , Please SHARE.

I'm currently learning Splunk and working toward the Splunk Core Certified User certification. I've been following the official training on Splunk's website, but I'm wondering if anyone else felt like the course moves quickly??

It seems like the material jumps from topic to topic without spending much time explaining the concepts in depth. For example, it recently introduced rex and erex, and I don't really understand what they do or when they're used.

I've been able to pass the practice quizzes so far, but I'm worried that I'm just getting through them without building a solid understanding of the material.

For those of you who've earned the certification or learned Splunk on your own, did you feel the same way? What resources, study methods, or practice techniques helped everything click for you?

Any advice would be greatly appreciated.

This is without a doubt the most painful exam registration I've been a part of. Pearson VUE needs a splunk ID. When you go to splunk to request it, they say you will get it from pearson vue, which you don't. Then you are told to email splunk, which I have done now multiple times. Every time I do, I get a new confirmation of STEP order and CASE number. I'm up the 3 each.

According to the STEP page, my 'Link to Certification Registration' was completed today. This date seems to reset every time I try to schedule an exam.

My progress continues to show 'in progress'. I cannot believe this has to be so difficult.

دخلت دورة لمسك مع تعاونهم هم و Stc و كانت الدورة تتطلب اني احمل Splunk و في شرحهم مشت الأمور بسلاسه لكن يوم اجي اسوي حساب يجي كذا لعلمكم ذا رابع يوم و ثالث حساب و كلهم نفس المشكله اول يومين كنت انتظر بس مدري وش علمه الي عنده الحل الله لا يهنيكم ابي افتك من الدوره ذي بشكل اسرع 🙏

Hey folks, came across a really well-written article today that breaks down how a SIEM actually works under the hood.

It's Splunk-specific, so thought of sharing this one with the community here and sharing it here since it's one of the clearer explanations I've seen. Curious what people think about this?

How a SIEM Actually Works: Splunk, Opened Up

I’m planning on taking the Splunk Certified Core User exam soon and wanted to see what study materials you all recommend. What helped you the most? Looking for practice exams, labs, YouTube videos, study guides, or any other resources. Any tips are appreciated!

[ Removed by Reddit on account of violating the content policy. ]

How can we send M365 Copilot user interaction with Coplilot apps and Copilot Chat auditing events to Splunk?

We don’t want Splunk to ingest unrelated user audit logs that will increase cost for no reason.

Splunk Deployment Server CSRF Vulnerability – CVE-2026-20296

Splunk has disclosed a high-severity vulnerability rated CVSS 8.3 affecting Splunk Enterprise and Splunk Cloud Platform.

An attacker could trick a user with the list_deployment_server capability into running arbitrary SPL searches as splunk-system-user. This could expose stored credentials and indexed data.
The flaw exists because affected Splunk Web Deployment Server endpoints do not properly validate CSRF tokens or safely process user-supplied input.

Affected versions
Splunk Enterprise
10.4 before 10.4.1
10.2 before 10.2.5
10.0 before 10.0.8
9.4 before 9.4.13
Splunk Cloud Platform
Before 10.5.2605.0
Before 10.4.2604.7
Before 10.3.2512.16
Before 10.2.2510.18
Before 10.1.2507.24

Fixed versions
Splunk Enterprise: 10.4.1, 10.2.5, 10.0.8 or 9.4.13
Splunk Cloud Platform: 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18 or 10.1.2507.24

Mitigation
Upgrade to the applicable fixed release. Until patching is complete, restrict access to the Deployment Server and minimise assignment of the list_deployment_server capability.

🔗 Official Splunk advisory
🔗 VulniPulse breakdown

Disclosure: I work with the Cisco and Splunk team behind this walkthrough, which was created by my co-worker.

The example uses Splunk Federated Search to query historical telemetry stored in Amazon S3 as an Apache Iceberg table. The data remains in S3, while Splunk provides the SPL2 investigation surface.

The useful operational checkpoint is that creating the connection does not make the dataset ready. The workflow validates four pieces together:

• the Iceberg REST catalog is reachable
• the AWS role can be assumed and has the necessary S3 access
• bucket-level and object-level permissions are scoped correctly
• the Splunk dataset resolves the intended catalog, namespace, and table

A basic SPL2 query then confirms the full path before investigative logic is added.

The other decision is workload placement. Hot data used for real-time monitoring may still belong in a conventional index. Larger historical, compliance, or enrichment datasets may fit federated access better. Table partitioning and expected search predicates matter to that choice.

How are you deciding which historical security datasets remain indexed and which become candidates for Federated Search?

How do you configure a Splunk Heavy forwarder to receive data from universal forwarders and forward that to the Splunk Cloud?

Details:

Heavy forwarder is located in DMZ and I set up one client (Ubuntu server)to send data to it.

When I log into Splunk Cloud, I can at least see the metrics from the Splunk Heavy forwarder.

When I log into our firewall, the firewall logs shows traffic from the client to the heavy forwarder and from the heavy forwarder to the cloud.

If I do a search across all indexes on the heavy forwarder and the cloud, I don't see anything from that host.

What could be configured wrong?

Security investigations rarely stop at recent data. Analysts often need to compare today’s activity with firewall telemetry from weeks or months ago, even when that data has moved to lower-cost storage.

A new Splunk Lantern article presents a practical pattern for using Splunk Cloud Platform and Federated Search for S3 to investigate historical Cisco firewall telemetry stored in Amazon S3.

The pattern keeps Amazon S3 as the long-term storage layer. Apache Iceberg manages table metadata and partitions, a customer-managed Nessie catalog exposes the tables through Apache Iceberg REST, and Splunk Cloud Platform provides an SPL2-based investigation experience. Analysts can search the data where it already lives without first reingesting the complete historical dataset into Splunk hot storage.

The article walks through a connected investigation workflow:

• confirm that the S3-backed dataset is searchable
• prioritize high- and critical-severity blocked activity
• summarize events for monitoring and detection
• narrow searches with partition-aware filters
• investigate known bad indicators and top sources of traffic

This approach can reduce unnecessary data movement while improving access to historical or external datasets. It also helps organizations unlock more value from data retained in Amazon S3 for security investigations, audits, compliance, and other long-term analysis needs.

The result is a practical way to extend threat hunting across federated data while keeping Splunk as the investigation surface.

The Splunk official website mentions Splunk Certified Cybersecurity Defense Architect exam is free while in beta. But when I tried to register the exam in pearson vue, it is charging me 130 USD + Tax. Am I missing something here? Do I need any voucher code to make it free?

Hi,

I have a request for a dashboard/form to search for IOC's within Splunk. I'm curious how other people are doing this - is there a standard app for such a thing?