The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the integration of Artificial Intelligence (AI) and Machine Learning (ML) is revolutionizing the way organizations maintain observability over their systems. Observability practices are enhanced by AI and ML to predict and prevent incidents before they occur, leading to significant improvements in reliability, availability, and customer experience. These technologies are applied across varying maturity stages, from gaining basic visibility to employing advanced predictive models that preempt potential issues. 1  The financial implications of downtime are profound, with each hour potentially costing organizations an average of $365,000, thus underscoring the critical need for efficient operational practices. This blog explores the transformative impact of AI and ML on observability within IT environments, demonstrating the benefits through various use cases and highlighting the substantial return on investment for organizations that adopt these practices. Harnessing AI and ML for Enhanced Observability   Organizations increasingly recognize the benefits of observability in enhancing reliability, availability and customer experience. The integration of Artificial Intelligence (AI) and Machine Learning (ML) into observability practices offers predictive capabilities, allowing for the anticipation and prevention of incidents before they occur. AI and ML are applied in three maturity stages for observability: from basic visibility without AI to proactive AI that establishes baselines for normal operations, and finally, to advanced predictive models that can preempt potential issues based on historical data. One of the roles of AI in observability is to provide a deeper understanding of 'normal' operational patterns and to direct attention to anomalies that require immediate action. This approach is instrumental in resolving issues faster, reducing downtime impact, and instilling confidence in maintaining customer-facing and internal services.     The complexity of modern technology stacks makes it challenging to discern operational health, a dilemma that AI and ML help to address by centralizing visibility and offering actionable insights. Features that support this include dynamic baselining, predictive modeling, and improving detection accuracy. These capabilities are encapsulated in a variety of products designed to simplify the adoption of AI and ML for organizations, regardless of their current maturity stage in observability. Understanding AIOps and Its Practical Applications   AIOps is the application of AI and  machine learning to operations. This includes anomaly detection, alert noise reduction, probable root cause, automation and remediation, and proactive prevention.. The importance of AIOps stems from its ability to predict and prevent potential IT issues before they impact customers, which is crucial for maintaining high availability and reliability of IT services. AIOps has a range of use cases, demonstrating its benefits across various scenarios. For instance, it aids in swiftly resolving downtime, enhancing detection efficiency, and reducing manual processing efforts. A practical example includes an organization that shifted from static to dynamic thresholding to improve alert accuracy, as static thresholds were either overwhelming during peak hours or missing anomalies during off hours. This shift led to massive improvements in detection efficiency. The monetary benefits of AIOps adoption are significant. Moreover, downtime not only incurs financial losses but also damages reputation, sometimes causing customers to switch to competitors. AIOps steps in as a vital tool to navigate the complexities of modern IT environments, providing a predictive approach to maintaining service performance and preventing issues. It achieves this by collecting data, defining Key Performance Indicators (KPIs), establishing baselines for typical performance, and building predictive models to anticipate and mitigate potential issues.   While the implementation of AIOps may seem challenging, tools and products are available to facilitate the transition, allowing organizations to start with simple use cases and gradually progress to more complex applications. Overall, AIOps offers a path to proactive IT operations management, enabling organizations to stay ahead of potential service performance issues and drive better business outcomes. The Challenge of Observability in the Age of Big Data   In today's digital landscape, organizations are grappling with the immense volumes of data generated by their IT environments. This surge in data presents a significant challenge in maintaining observability over their systems. As data volumes expand, the task of monitoring and managing the performance of IT services becomes increasingly complex. One of the critical issues faced in this scenario is the phenomenon of 'alert storms,' where the sheer quantity of alerts overwhelms the IT teams, making it difficult to pinpoint and troubleshoot performance issues effectively. The recent Splunk AI for Observability webinar revealed that organizations are indeed in the midst of what could be described as the 'perfect storm' of challenges, with many participants acknowledging struggles with growing data volumes, alert storms, and troubleshooting. Among these, too many alerts stood out as a particularly prominent issue, as it can obscure the root causes of performance degradation, leading to extended downtime and a scramble to restore services. The economic impact of such downtime is staggering. A survey published in the 'Digital Resilience Pays Off' report highlighted that, on average, each hour of downtime can cost organizations up to $365,000, not to mention the potential reputational damage that can arise from poor customer experiences. To combat these issues, organizations are turning to artificial intelligence (AI) to enhance their observability practices. AI is leveraged to predict or prevent incidents before they occur, and customers are segmented into three maturity stages based on their use of AI. The most advanced customers employ predictive models that can foresee and mitigate negative outcomes, whereas the less mature ones are yet to harness AI's full potential. In conclusion, the path to overcoming the challenges posed by growing data volumes lies in the strategic application of AI. The Evolution and Impact of AI and ML    Artificial Intelligence (AI) and Machine Learning (ML) have become integral components of Splunk products, offering significant advantages in detecting service performance issues. The integration of these technologies within Splunk's suite has a rich history, with nearly a decade of implementation. The profound impact of AI and ML is evident in the ability to predict or prevent incidents before they happen, enhancing the observability of systems. Organizations leveraging AI and ML in Splunk's offerings report substantial benefits, such as accelerated problem resolution and enhanced reliability of customer-facing and internal services. The evidence supporting the return on investment for those adopting observability practices is compelling, with statistics showing that each hour of downtime can cost an average of $365,000, highlighting the critical nature of maintaining operational efficiency. Successful AI and ML implementations have led to increased detection efficiency, reduced manual processing, and the identification of previously unknown scenarios within service performance. These advancements have been showcased through customer stories, such as the IG Group's transition from static thresholds to dynamic baselining, which has drastically improved detection efficiency. Another example is AIB's use of Splunk products to facilitate triage processes, leading to the discovery of an issue caused by unusual snowfall in Ireland. Lastly, StubHub's use of baseline models helped control application errors and uncover hidden issues. To streamline the adoption of AI and ML, Splunk ensures its products are accessible and supportive of users at any stage of their AI and ML journey, from simple use cases to complex predictive model deployments. The Splunk App for Anomaly Detection exemplifies this commitment, automating the detection of anomalies in key metrics and KPIs, thereby demonstrating Splunk's dedication to enhancing service performance through advanced technology. Enhancing Operational Efficiency with Anomaly Detection    The introduction of the Splunk App for Anomaly Detection marks a significant advancement in operational efficiency for organizations leveraging Splunk’s AI capabilities. A demonstration of this app in action reveals its capacity to effortlessly operationalize anomaly detectors for actionable alerting, thus simplifying the traditionally complex and technical process of anomaly detection. By automating the configuration for specific metrics or KPIs, the app streamlines the machine learning process to detect anomalies at ingest time, effectively removing barriers such as the need for complex SPL, statistical knowledge, and parameter tuning. The benefits of implementing anomaly detection are substantial and multifaceted. The demonstration highlights how this technology enables organizations to detect both isolated point anomalies and sustained anomaly intervals, accompanied by confidence scores to gauge the significance of the detected anomalies. Moreover, the app facilitates efficient detection by alerting users when anomalies with high confidence scores are found, and provides the SPL query generated by the app for further use within Splunk. Operational efficiency is further enhanced when anomaly detection is paired with predictive AI capabilities. Organizations can predict potential incidents before they occur, mitigating downtime and improving service reliability. This predictive approach is demonstrated by the Anomaly app's ability to identify anomalous behavior and to recommend appropriate actions in real-time, thus preventing potential service disruptions.     In conclusion, the Splunk App for Anomaly Detection exemplifies the intersection of AI and operational efficiency, providing a powerful tool for organizations to proactively manage and maintain the performance of their systems and services. Understanding Splunk's AI Principles and the AI Assistant   Splunk integrates AI into its observability suite, offering domain-specific AI capabilities that enhance the efficiency of AI-driven processes. The involvement of humans remains crucial, ensuring that AI assists rather than replaces human decision-making. A notable innovation is the introduction of the Splunk AI Assistant for SPL, which simplifies the creation of SPL queries and their understanding. This assistant, currently in public preview, promises to unlock the full potential of SPL-powered Splunk products. Statistics underline the importance of AI in observability, demonstrating how AI applications in Splunk significantly reduce downtime costs, which can average $365,000 per hour. With complex technology stacks, AI helps organizations predict and prevent incidents, using models to forewarn about potential issues and enabling quick resolution. The AI-driven capabilities are designed to be open and extensible, allowing users to customize models or employ their own, maintaining Splunk's versatile problem-solving essence. The Splunk AI Assistant aims to be a scalable aid across the ecosystem, with future enhancements like an AI assistant for observability cloud and an improved adaptive thresholding experience. In essence, Splunk's AI principles and the AI Assistant offer a comprehensive, user-friendly AI integration that fosters proactive, informed, and efficient observability practices. Enhancing Security and Observability with AI and Unified Platforms   The integration of Artificial Intelligence (AI) into observability practices significantly accelerates the ability to detect, investigate, and respond to incidents. AI's role in enhancing security and observability is pivotal, particularly in predicting or preventing incidents before they occur. Organizations are adopting AI to gain insights on what normal performance looks like in their environments and to detect deviations that may indicate emerging issues. With the growth of data volumes and the complexity of technology stacks, AI becomes an indispensable tool in managing alert storms and troubleshooting performance issues. A survey by Splunk has found that each hour of downtime can cost organizations an average of $365,000, underscoring the financial impact of operational disruptions beyond the reputational damage it may cause to customer-facing services. The comprehensive nature of the Splunk platform caters to this need, with its decade-long incorporation of AI and machine learning to support a wide range of use cases. Furthermore, the importance of a unified platform cannot be overstated. Splunk's unified platform serves as a cohesive foundation for SecOps, ITOps, and DevOps teams, providing solutions that are tailored to their specific requirements while reaping the benefits of a holistic approach. This unified approach ensures that these teams can operate more efficiently, with better visibility and tools for rapid response, thereby reducing mean time to resolution (MTTR) and mitigating the risk of service performance issues. AIOps: A Mature Approach to Observability   In the increasingly complex IT landscape, AIOps emerges as a mature approach to observability, playing a pivotal role in enhancing incident response and operational efficiency. This approach is fostered by the need to predict or prevent incidents before they occur, leading to continuous improvement and predictive analytics capabilities within IT operations. The integration of AIOps has demonstrated a significant impact, particularly in the realm of incident management. Organizations that embrace AIOps have observed a faster resolution of problems, resulting in improved availability and reliability of services. Notably, customers leveraging AIOps have reported the ability to fix issues more swiftly and confidently maintain customer-facing and internal services. A mature AIOps strategy encompasses various stages of implementation, ranging from basic visibility into IT environments to advanced predictive models. These models can anticipate potential negative outcomes based on historical data, enabling preemptive remediation efforts. The statistical evidence supporting AIOps is compelling, with reports indicating that each hour of downtime can cost an average of $365,000, highlighting the financial incentives to adopt such strategies. Moreover, AIOps facilitates the identification of previously unknown scenarios, thereby driving innovation and informed decision-making. The journey toward AIOps maturity not only increases detection efficiency but also reduces manual processing and uncovers new insights, all of which contribute to the overarching goal of achieving digital resilience and operational excellence.     In conclusion, the integration of AI and ML into observability practices is recognized as a transformative force in IT operations. It is demonstrated that these technologies significantly enhance the ability to predict and prevent incidents, leading to improved service reliability and customer experience. The financial benefits are underscored by the high cost associated with downtime, encouraging organizations to adopt AI and ML to maintain operational efficiency. Through various use cases, the effectiveness of AI-driven solutions in addressing complex technology stack challenges is illustrated, showing a substantial return on investment. A mature approach to observability, encompassing AIOps, is presented as essential for ongoing improvement and innovation within organizations. It is concluded that AI and ML are indispensable in the contemporary digital landscape for driving business resilience and efficiency.   1  From Digital Resilience Pays Of (p.7) by  Splunk © 2023 Splunk Inc.  ... View more

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance Monitoring In today's digital landscape, the adoption of Splunk Real User Monitoring (RUM) and Splunk Application Performance Monitoring (APM) is pivotal for organizations aiming to enhance their web presence and user experience. RUM is diligently employed to monitor the genuine interactions of users with web and mobile applications, providing a granular view of user experience in real-time. Concurrently, APM is harnessed to investigate application performance, offering critical insights into transaction speeds and system health. Both are integral components of an observability suite that caters to the multifaceted nature of modern digital ecosystems, which encompass on-premise, hybrid, and multi-cloud environments. The integration of RUM and APM is showcased as a strategic move within a growth engineering team, underscoring its significant role in improving marketing operations and public-facing websites. By using observability tools, we can take a preemptive and informed approach to delivering digital services. This shifts incident management from reactive to showcasing digital resilience and excellence.   Understanding Splunk RUM and APM in Observability Practices     Driving Customer Experience With Splunk Observability: A Growth Engineering Team's Story Learn  how the growth engineering team at Splunk adopted Splunk Observability to improve incident detection, resolution, and customer experience. Watch Real User Monitoring (RUM) and Application Performance Monitoring (APM) are essential components of Splunk's observability suite. Their adoption by Splunk's growth engineering team signifies a strategic move towards enhancing the company's marketing operations and public-facing websites. RUM is integral for monitoring the actual experiences of users interacting with web and mobile applications, while APM focuses on the performance of applications, offering insights into transaction speeds, error rates, and system health. Splunk's observability products offer a unified solution for monitoring digital ecosystems that span across on-premise, hybrid, and multi-cloud environments, addressing the complexities that come with integrating multiple technologies and services. By adopting Splunk observability, organizations can achieve digital resilience, enabling them to recover swiftly from disruptions, adopt new operating models quickly, and ensure reliable and outstanding digital experiences for their customers. The growth engineering team within Splunk's marketing organization is a prime example of how internal teams are leveraging these tools to improve efficiency, detect incidents faster, and align business priorities. The team's journey to utilizing RUM and APM has led to impressive results, such as faster page load times, increased engineering efficiency, and significant improvements in core web vitals. These improvements are a testament to the power of a comprehensive observability strategy, which can transform reactive incident management into a foresighted approach to digital service delivery. The Growth Engineering Team's Path to Digital Resilience     Leveraging Splunk Observability for Complex Technology Stacks Explore how Splunk transitions its AEM stack to the cloud and leverages Splunk Observability to manage complex technology ecosystems and deliver exceptional customer experiences. Watch now   The Growth Engineering Team at Splunk has embarked on a digital resilience journey, with the mission to maintain public-facing websites and internal portals. Their objective is to provide a world-class customer experience by leveraging the power of Splunk products. To achieve this goal, the adoption of observability tools became imperative to address inefficiencies and the apparent lack of service health visibility. With the introduction of Real User Monitoring (RUM) and Application Performance Monitoring (APM), the team is now equipped to detect incidents, isolate and prioritize events, and accelerate root cause analysis effectively. This strategic move has enabled the team to transform from a reactive to a forward-thinking approach, enhancing their ability to recover quickly from disruptions and adopt new operating models seamlessly. The adoption of Splunk's observability tools has proven to be a critical step in the team's journey towards digital resilience. Observability has provided the team with end-to-end visibility, allowing them to monitor the health of their services and correlate events across different teams and microservices. This unified perspective is essential for resolving issues rapidly and efficiently. As a result of these efforts, the team has reported significant improvements in key performance indicators, including faster page load times, increased engineering efficiency, and improved core web vitals. The team's utilization of RUM has been particularly impactful, allowing them to track automated user sessions across websites and applications. For instance, when trial sign-ups on the website were failing, RUM enabled the engineering team to quickly identify and resolve the issue, minimizing the potential impact on users. Similarly, APM has been instrumental in ensuring the performance of business-critical workflows. During a product release, APM allowed the team to address an outage alert swiftly, maintaining a 99.9% uptime and boosting engineering productivity by 50%. Overall, the integration of RUM and APM has set the stage for a more resilient digital presence, empowering the Growth Engineering Team to deliver superior customer experiences and drive business success. This journey towards digital resilience serves as a testament to the power of observability tools in optimizing user experience and operational efficiency.   Maximizing Digital Resilience: The Power of APM and RUM in Action     Comprehensive Application Performance Monitoring and User Experience Analysis With Splunk APM and RUM Discover how Splunk APM provides distributed tracing and detailed error capture, while RUM offers real-time user experience monitoring and error tracking. Watch now Application Performance Monitoring (APM) and Real User Monitoring (RUM) are crucial for ensuring service health and optimizing user experiences. Internally, Splunk leverages its own suite of products, including APM and RUM, to monitor and enhance its service offerings. The utilization of these tools within the growth engineering team is shared, demonstrating the tangible advantages of APM and RUM. APM and RUM collectively provide comprehensive visibility into how services perform and how users interact with applications. By integrating both front-end and back-end monitoring, teams can rapidly identify and resolve issues, often before they significantly impact users. These tools offer capabilities ranging from detailed waterfall charts of user interactions to real-time correlation of traces, which are instrumental in accelerating troubleshooting efforts. Splunk's internal stories serve as a testament to the effectiveness of APM and RUM. One case study highlights the ability of RUM to detect and address a failure in website sign-up forms, allowing for a swift resolution that was three times faster, thereby preserving the company's brand reputation. Another example showcases how APM enabled the back-end engineering team to maintain a 99.9% uptime and improve engineering productivity by 50% despite increased traffic. The integration of APM with RUM is particularly beneficial, as it connects front-end user experiences with back-end service performance, providing a holistic view of the system. This end-to-end visibility is crucial for monitoring complex ecosystems, such as Splunk.com, with its multitude of endpoints. By using APM and RUM in unison, teams can now monitor and optimize Splunk's digital ecosystem more efficiently. The success of APM and RUM integration at Splunk is quantifiable, with impressive key performance indicators (KPIs) such as a 50% faster page load times, a 25% increase in engineering efficiency, and a 60% improvement in core web vitals. These statistics underline the transformative impact of Splunk's observability tools in creating resilient digital experiences and fostering a forward-thinking approach to service health management.   Understanding APM and RUM Capabilities for Optimized User Experience     Maximizing User Satisfaction and Business Goals With APM and RUM Correlation Discover how the correlation of Application Performance Monitoring (APM) and Real User Monitoring (RUM) provides end-to-end visibility, effective root cause analysis, and improved performance optimization. Watch now Enhancing Digital Experiences with APM and RUM   The implementation of Splunk Application Performance Monitoring (APM) and Splunk Real User Monitoring (RUM) within growth engineering teams has led to significant advancements in page load times and engineering efficiency. Through the implementation of these tools, businesses have observed a significant enhancement in core web vitals and the ability to proactively identify issues. This shift towards a more foresighted approach has been facilitated by the adoption of observability, resulting in a transformation of operational strategies. The integration of APM and RUM has empowered teams to gain comprehensive insights into both front-end and back-end systems, enabling a unified approach to issue resolution. This has led to a more efficient and effective method for addressing incidents, with teams now able to quickly zoom in on the performance of critical workflows and preemptively address potential issues before they escalate. The success stories shared emphasize how APM and RUM have revolutionized the monitoring and optimization of digital services, ensuring high availability and optimal performance. These tools not only provide real-time visibility into user experiences but also facilitate faster troubleshooting and resolution, ultimately enhancing the digital experience for both users and the organization. Conclusion  In conclusion, the implementation of Application Performance Monitoring (APM) and Real User Monitoring (RUM) is demonstrated to be essential for achieving digital resilience. Enhanced user experiences and operational efficiency are achieved through the adoption of these monitoring tools. Organizations are empowered to proactively identify and resolve issues, thereby maintaining high service uptime and improving core web vitals. The integration of APM and RUM enables a seamless correlation between user interactions and application performance, offering a comprehensive observability solution. This approach results in significant improvements in page load times and engineering productivity. By leveraging the capabilities of APM and RUM, a transformation in incident management is facilitated, transitioning from a reactive to a preemptive stance in digital service delivery. Speakers Sudhaker Adusumilly, Senior Director, Head of Growth Engineering, Splunk Sandeep Kampa, Sr DevOps Engineer, Growth Engineering, Splunk   Looking for More? Watch the full Demo   In this demo, Sandeep Kampa, Sr DevOps Engineer at Splunk discusses the powerful capabilities of Splunk APM and RUM, demonstrating how they can revolutionize application performance and user experience. He showcases key features such as service maps, error tracking, and the correlation between APM and RUM for comprehensive front-end and back-end analysis. The walkthrough includes a practical example of troubleshooting a real-world issue with the integrated tools, highlighting their ability to reduce resolution time and improve operational efficiency. Watch now   Watch the full Tech Talk   ... View more

How to Use Logs from Splunk Platform in Splunk Observability   Logs play a critical role in identifying why there is a problem and, when combined with metrics and traces, help build strong observable systems. For that reason, ITOps and engineering teams need a robust and well-rounded logging tool to be able to successfully perform troubleshooting and monitoring across any environment. However, they often have to deal with tool sprawl that leads to a broken troubleshooting workflow and longer time to resolve or over complicated solutions that require coding or infrastructure overhead. In this webinar, find out how to combine Splunk Platform’s power with Splunk Observability Cloud. You’ll learn how easily you can extend logs from Splunk Cloud Platform or Splunk Enterprise into Splunk Observability Cloud, a solution purposefully built for hybrid troubleshooting. You’ll also discover how seamless it is to correlate logs with traces and metrics in a single point-and-click interface for improved visibility of your environment.   The Convergence and Power of Observability in Modern Software Development Understanding the convergence of Observability as a powerful group of different parts that work together to improve business resiliency and solve operational inefficiency. Watch Now Maximizing the Power of Splunk Cloud and Observability Cloud Integration Learn how to seamlessly connect and leverage the combined benefits of Splunk Cloud and Observability Cloud for streamlined log analytics and real-time monitoring. Watch Now Understanding Log Observer Connect in Splunk Cloud Explore the process of setting up Log Observer Connect between Splunk Observability Cloud and Splunk Cloud, including prerequisite steps and role-based access control. Watch Now Automating Network Level Connection for Observability Cloud and Splunk Cloud Learn how to automate the secure network level connection between Observability Cloud and Splunk Cloud for seamless data access and troubleshooting. Watch Now   Want to see more? Watch the Full Webinar   Key Takeaways: How to centralize your log management across ITOps and engineering use cases Enjoy a no-code and intuitive interface to easily explore log data Combine logs with Infrastructure Monitoring (metrics) and APM (traces) for faster root cause analysis Speakers: Joanna Zouhour, Product Marketing Manager Observability, Splunk Subu Baskaran, Principal Product Manager, Splunk     ... View more

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, Starting With Observability: OpenTelemetry Best Practices explored the foundational technology and framework of OpenTelemetry, focusing on its role in enabling observability practices and its rapid adoption across various industries. It emphasizes the value of deploying the OpenTelemetry collector and the recommended modes of deployment, such as Agent mode and Gateway mode. Hear from Splunk’s Observability Practitioner Director, Greg Leffler, as he delves into tips and tricks for using OpenTelemetry, understanding the deployment options, and choosing the appropriate deployment model based on the specific needs of the environment.   Exploring OpenTelemetry: An Introduction to Observability Understanding OpenTelemetry: A Framework for Observability Learn about OpenTelemetry, a foundational technology used for observability, its components, integrations, and benefits for monitoring and instrumentation across various platforms and languages. OpenTelemetry, a buzzword that has caught the attention of many, is the focus of this edition of Splunk's Tech Talks. The session delves into the foundational technology and framework that OpenTelemetry offers for observability. It is designed to capture distributed traces, metrics, logs, and more, providing a standard way to enrich data. OpenTelemetry also stands out for its flexibility and lack of vendor lock-in, offering users full control over their telemetry data. The webinar highlights the importance of OpenTelemetry, emphasizing its role in enabling observability practices and its rapid adoption across various industries. According to the speaker, a significant number of organizations are already embracing observability, recognizing its value and the need for dedicated experts in this field. The session also addresses the process of getting started with OpenTelemetry, emphasizing the significance of deploying the OpenTelemetry collector and the recommended modes of deployment, such as Agent mode and Gateway mode.   Implementing OpenTelemetry: Starting Small and Necessary Configurations Getting Started With Splunk and OpenTelemetry: Installation and Configuration Guide Learn how to easily start using Splunk with OpenTelemetry, whether you're a Splunk customer or not, by following the installation and configuration steps. When implementing OpenTelemetry, it is crucial to start small and gradually expand a deployment. By beginning with one service or a specific environment, it allows for a better understanding of the benefits and facilitates easier configuration adjustments. Additionally, it is important to ensure the necessary extensions are enabled for seamless troubleshooting and data processing. Extensions such as health checks, zpages, and batch are essential for monitoring the performance of data pipelines. Moreover, log collection via the Filelog receiver can be considered to reduce the number of needed agents. By following these steps, the implementation of OpenTelemetry can be streamlined and optimized for effective observability. It's also worth noting that the majority of business cases involve the deployment of OpenTelemetry in Agent mode, which is the most common and recommended approach for collecting host metric data and forwarding application data to the observability backend. However, in complex environments or where scalability and network traffic need to be managed, deploying the collector in gateway mode might be more suitable.   Tips and Tricks for Using OpenTelemetry   When using OpenTelemetry, it is essential to consider the deployment mode that best suits your environment. The most common mode is the Agent mode, which is deployed onto every machine to collect host metric data and forward application data to the observability backend. However, for complex environments with potential network constraints or scalability concerns, the Gateway mode is a viable option. In Gateway mode, the agent can still run on every machine but it would then direct data to a gateway machine before sending it to the observability backend, addressing issues related to network traffic and data volume. Additionally, in cases where the collector is not required, such as in platform-as-a-service systems, applications can directly emit data to endpoints without the need for a collector. Understanding the deployment options and choosing the appropriate mode based on the specific needs of the environment is crucial for effective implementation of OpenTelemetry.   Understanding OpenTelemetry Collector Deployment Modes Understanding the OpenTelemetry Collector and Ecosystem Explore the functionalities of the OpenTelemetry collector, including receivers, processors, extensions, and exporters, enabling efficient data collection and integration with various formats and destinations. The OpenTelemetry collector offers two deployment modes: Agent mode, Gateway mode. You can also use OpenTelemetry without the collector (No Collector mode). In Agent mode, the collector is deployed on every machine to collect host metric data and application data, forwarding it to the observability backend. This mode is recommended for most common environments. On the other hand, Gateway mode involves running the agent on every machine but instead of sending data directly to the observability backends, sending it to a gateway machine, which then communicates with the observability backend. Gateway mode is suitable for complex environments, large-scale deployments, and where network traffic and overall performance of the observability infrastructure need careful consideration. Alternatively, in scenarios where the collector is not required, such as in platform as a service systems, applications can directly emit data to endpoints without the need for a collector. This 'No Collector' mode is ideal for simple applications that require minimal instrumentation. Understanding these deployment modes is crucial for optimizing the performance and efficiency of the OpenTelemetry collector in different deployment scenarios. Ready to Watch the Full Recording? Starting With Observability: OpenTelemetry Best Practices Watch the Replay Exploring Key Features of OpenTelemetry Exploring Zpages: A Hidden Gem in OpenTelemetry Collector Discover the power of Zpages in OpenTelemetry Collector for monitoring and troubleshooting pipelines with ease. OpenTelemetry offers a range of powerful features designed to enhance observability and streamline the collection of crucial data. One noteworthy feature is the zpages extension, which provides valuable troubleshooting insights. By enabling the zpages extension during the setup of the OpenTelemetry pipeline, users gain access to configz, statsz, rpcz, and tracez. These components offer real-time visibility into the internal workings of the collector, simplifying the troubleshooting process and providing essential performance metrics. The OpenTelemetry pipeline is a core component that supports receivers, processors, and exporters. Receivers are capable of accepting data in various formats, including OTLP, Jaeger, Prometheus, and more, ensuring flexibility in data ingestion. Processors allow for data manipulation, such as sampling, batching, and filtering, offering extensive customization options. Exporters then facilitate the transfer of data out of the collector, enabling seamless integration with observability backends. Furthermore, OpenTelemetry promotes both automatic and manual instrumentation.   Getting Started with OpenTelemetry Getting Started With Splunk and OpenTelemetry: Installation and Configuration Guide Learn how to easily start using Splunk with OpenTelemetry, whether you're a Splunk customer or not, by following the installation and configuration steps. To begin with, automatic instrumentation should be the starting point for any OpenTelemetry deployment. It eliminates the need to understand OpenTelemetry in significant depth, making it a suitable option for most use cases. However, if automatic instrumentation is not available for certain languages or frameworks, manual instrumentation can be added as needed. For Splunk customers, using resources such as the Cloud Native Computing Foundation Slack and Splunk Professional Services is highly recommended. The Slack channel provides real-time access to OpenTelemetry experts for specific problem-solving, and Splunk Professional Services can offer valuable support and guidance, with assigned experts on Splunk and OpenTelemetry available. Joining the Cloud Native Computing Foundation Slack is essential for gathering insights and assistance related to OpenTelemetry. The community-focused program allows users to engage with knowledgeable individuals and stay updated on the latest developments. It's crucial to initiate an OpenTelemetry deployment as soon as possible, as it provides an opportunity to gain experience and familiarity with the system.   Deploying the Collector: Platforms and Steps Getting Started With Splunk Observability Cloud: Deploying the OpenTelemetry Collector Learn how to deploy the OpenTelemetry Collector in Splunk Observability Cloud and configure it using the provided configuration files. The OpenTelemetry collector can be deployed on various platforms, including Linux, Windows, Kubernetes, and EC2. The deployment can also be carried out in different modes, such as agent or gateway. It is recommended to use the agent mode for deployment. In Splunk Observability Cloud, the process begins with clicking on the 'Add Integration' option and selecting OpenTelemetry as the integration of choice. This initiates a wizard to set up the collector. The installation process requires the use of cURL to download the setup script, which then determines the realm of the observability cloud install and the access token to be used. Additionally, the Java zero-touch instrumentation can be enabled during the deployment process. Once the deployment is completed, the configuration file for the collector is located at /etc/otel/collector/config.yaml, and the environment variables are specified at /etc/otel/collector/splunk-otel-collector.conf.   Configuring the Splunk OpenTelemetry Collector Getting Started With Splunk Observability Cloud: Deploying the OpenTelemetry Collector Learn how to deploy the OpenTelemetry Collector in Splunk Observability Cloud and configure it using the provided configuration files. The configuration of the Splunk OpenTelemetry Collector is an essential aspect of setting up and optimizing your observability platform. The collector relies on two key configuration files, which hold critical information about the collector's operation and behavior. The configuration file for the collector is located at /etc/otel/collector/config.yaml, while the environment variables are specified in /etc/otel/collector/splunk-otel-collector.conf. These files play a pivotal role in determining how the collector runs, the pipeline structure, and the settings for extensions and environment variables. Making changes to these configuration files is a straightforward process. Any modifications to the configuration files must be followed by a restart of the collector to ensure the changes take effect. It is important to note that the OpenTelemetry Auto Instrumentation package can also be installed, which automatically updates the ld.so.preload file, enabling automatic instrumentation of Java applications by simply restarting them.   Exploring OpenTelemetry Features: Enabling zpages Discover the power of Zpages in OpenTelemetry Collector for monitoring and troubleshooting pipelines with ease. Enabling zpages in the OpenTelemetry collector provides valuable insights into the system's performance and operation. These zpages offer a comprehensive view of the collector's inner workings and facilitate efficient monitoring and troubleshooting. Introduction to zpages: Zpages are an essential feature of the OpenTelemetry collector, allowing users to gain visibility into various aspects of the system. They offer detailed information about the collector's configuration, pipeline, extensions, and traces, enabling users to better understand the behavior of the collector. Different types of zpages: There are several types of zpages, each serving a specific purpose. These include the config zpage, pipeline zpage, extensions zpage, feature zpage, and trace zpage. Each type provides distinct insights into the functioning of the OpenTelemetry collector, allowing for comprehensive analysis and monitoring.   Conclusion In conclusion, OpenTelemetry plays a pivotal role in enabling observability practices, offering a standard way to enrich data and providing flexibility without vendor lock-in. The deployment of the OpenTelemetry collector, with a focus on agent mode and gateway mode, is crucial for effective data collection and forwarding to the observability backend. The deployment process involves utilizing cURL to download the setup script, determining the realm of the observability cloud install, and configuring the access token. Related Tech Talk OpenTelemetry: What’s Next. Logs, Profiles, and More. Watch the Replay   ... View more

During a recent Observability Tech Talk, attendees tuned in to discover Splunk's approach to digital experience monitoring. Splunk experts Connor Tye and Nivedita Narayanan discussed the different elements of Splunk's Digital Experience Monitoring (DEM) portfolio and how it can help you optimize your customer experience. You'll want to keep reading and explore how Splunk's DEM can help detect, alert and take action to address issues quickly and effectively.   Dive into the details of Splunk's Digital Experience Monitoring "Optimizing Digital Experiences with Splunk Observability: Combining Synthetics and RUM for Performance Monitoring"   The Importance of Digital Experience Monitoring for E-commerce Sites   Learn why robust digital experience monitoring is crucial to prevent card abandonment and build user trust in e-commerce sites. Digital experience monitoring is an important part of observing the performance and usability of websites and web applications. It is essential in today's world of digital transformation, where users demand seamless experiences and optimal performance from all the services they interact with. Splunk Observability offers two complimentary products for digital experience monitoring: Synthetics and Splunk Real User Monitoring (RUM). Synthetics uses synthetic data to identify potential performance issues before they reach customers, while RUM provides real user insights to understand how users are interacting with the service. Combining these two products provides a well-rounded solution for monitoring pre-production and production environments. Digital experience monitoring is no longer about simply monitoring uptime, as expectations have changed and the way services are hosted has evolved. With digital experience monitoring, we can monitor changes in page load time, web vitals, and third party services, thus ensuring a smooth user experience.   Monitoring Website User Experiences with Digital Experience Monitoring (DEM)   Digital Experience Monitoring (DEM) is a great tool to help identify user experiences. In this talk, we will discuss how DEM can be used to monitor a website. We will use a simple e-commerce website as an example. As a service owner of the website, we have noticed a delay in getting to checkout, which is not a great user experience. We will use Synthetics and RUM to measure the impact on the website. Synthetics is a set of transactions put together that each translate to steps and actions. For example, when a user searches for a product, adds it to their cart and checks out, these are three different actions that can be grouped into three transactions. RUM uses real data from users to build a portfolio. It requires little instrumentation and can be set up in less than an hour. With DEM, it doesn't matter what infrastructure is being used - on-prem, hybrid, or cloud customers can all access the service. Let's use DEM to monitor our website and see how it can help improve user experience.   Synthetic Monitoring Tool: Understand Your Workflow Performance and Identify Issues Quickly.   A great way to understand the performance of any workflow is to use the Synthetic Monitoring tool. This tool gives you a visual representation of what the user saw, as well as metrics associated with it. Through the waterfall feature, you can easily determine what elements of the page may be lagging and causing issues. Additionally, you can set up business transactions to specifically evaluate the checkout flow. For example, if the checkout flow is taking too long, you can immediately identify it in the Synthetic Monitoring tool. Moreover, if you have an APM product set up, you can further drill down to the root cause of the issue. Additionally, if the same page is instrumented for Real User Monitoring (RUM), you can get a landscape view of the different environments the issue is happening across. Through this, you can get a better understanding of how many people are using your product, and the different platforms and devices that are supported. This helps to provide a uniform user experience across the globe. "Proactively Identifying Performance Issues with Synthetic Monitoring and RUM Data"   Troubleshooting User Sessions in Multiple Browsers and Regions   Explore user sessions across different browser versions and regions to identify delays and troubleshoot performance issues. Synthetic monitoring allows us to proactively identify issues before users encounter them and ensure consistent performance across diverse usage scenarios. The Synthetics Run results page automatically populates RUM data and matches it with the normalized URL of the synthetic test. We can localize the RUM distribution to the same country or area as the test ran from, or switch to global users. RUM field data allows us to optimize user experience by providing insights into how real users interact with the application across geographic locations, devices, and browser platforms. This helps us to identify performance bottlenecks, pinpoint areas of improvement, and prioritize fixes for maximum user impact. "Optimizing the User Experience through Splunk's Synthetic Monitoring and Web Optimization Tools."   Splunk Synthetic Monitoring and Web Optimization: Enhancing User Experience   Learn how Splunk synthetic monitoring and web optimization can help identify and fix performance issues, ensuring a seamless user experience on your website.   Splunk's Synthetic Monitoring and Web Optimization capabilities provide users with the ability to test features and user journeys before they go live, receive step-by-step guidance to immediately improve their end-user experience, and prioritize issues based on severity and ease of solving them. Web optimization extends the monitoring process by providing insights into how to improve performance, and benchmarking pages against lighthouse scores, core web vitals and industry standards. It also allows users to compare pre- and post-code change performance, to test the results of new code. Web Optimization also assigns defects to the relevant roles, such as developers or designers, and orders them based on severity. "Splunk Synthetic Monitoring Enhances Setup Process with Record Functionality and Integrations"   Enhanced Integrations and Alerting Capabilities for Splunk Synthetic Monitoring   Discover the latest integrations and features of Splunk Synthetic Monitoring, including enhanced metric sending, dashboarding, alerting, and on-call notifications. Splunk recently introduced a new feature in synthetic monitoring to make the setup process faster. This feature, known as the Chrome Script Importer, enables users to record all interactions on a page and submit the file for the test setup. Additionally, Splunk synthetic monitoring has released five integrations with other Splunk products. These integrations allow users to send metrics via HECs for Splunk enterprise or cloud, send metrics to Splunk infrastructure monitoring, and view a digital experience in Splunk ITSI. Splunk on call also allows users to send on- call alert notifications to multiple team members. To further help users, Splunk provides guides, videos, and an eBook with best practices to optimize performance. Splunk also has a community site with answers and resources for digital experience monitoring. Lastly, Splunk ideas allows customers to submit new product enhancements or vote for existing ideas. We hope you have gained a better understanding of the features and capabilities of Rigor and Synthetics. If you have any other questions, please reach out and we'll be happy to help.   Want to learn more? Watch the full Tech Talk on-demand, From Clicks to Conversions: Tune Performance from the User Perspective. Also view resources and all the pressing questions submitted during the live event.    ... View more

  May 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another edition of indexEducation – the newsletter that takes an untraditional twist on what’s new with Splunk Education. Now coming to you monthly, we hope the updates about our courses, certification, and technical training will feed your obsession to learn, grow, and advance your careers. Let’s get started with an index for maximum performance readability: Training You Gotta Take | Things You Needa Know | Places You’ll Wanna Go Training You Gotta Take On the Pod | The World is Looking for People Like You If you have taken Splunk training courses, then you’re one of thousands every month who recognizes the value of Splunk and the technical training necessary to stay ahead in this exploding digital universe. And the world is looking for people like you! Having passion for continuous tech training and upskilling is just what the industry needs to fill a growing cybersecurity skills gap. Curious about the power you yield? Find out what an industry influencer, a Splunk thought leader, and an actual Splunk user/expert have to say about bridging the skills gap through continuous education. Gotta Take a Listen |  3-part podcast Workshop It | We Think There’s a Hero in All of Us Your hero’s journey to conquer Search Processing Language (Aka SPL) starts today. Venture into the world of (once) live, interactive Splunk technical training, claim victory over the content, and return to your organization with more knowledge about SPL than you ever imagined. It’s a three-part workshop replay taught by an experienced Splunk technical instructor – it’s free, it’s fast, it’s fun-damental! Gotta Search | Start your journey Things You Needa Know STEP Up | New Splunk Learning Platform We are excited to introduce you to the newest member of the Splunk Education family. Say hello to STEP, the shiny new place where all learners can now access Splunk technical training. Whether you’re in the market for flexible self-paced eLearning, easy-to-enroll-in instructor-led training, or the latest Splunk Certification exams, STEP will deliver. At Splunk, we believe that everyone, everywhere should have access to technical learning opportunities so they can grow their careers and be the ‘good guys’ who help their organizations stay ahead of the ‘bad guys.’ Needa Get Upskilled | Take the first STEP New Certification Badge | I Survived Vegas Ok, so the badge isn’t called, “I Survived Vegas,” but we are (for real) announcing a new certification at Splunk .conf23 in Las Vegas. If you’re going to this year’s conference, then this is your exclusive opportunity to take the new Splunk Certified Cybersecurity Defense Analyst (CDA) exam. This is a beta exam, so it’s free to register and only available at .conf23 from July 17 through July 20, 2023. Oh, and while you’re with us in Vegas, you can also take any Splunk certification exam on-site for only 25 bucks! Say it with us – 25 bucks per badge. Needa New Badge | Get your CDA at .conf23 Places You’ll Wanna Go The Success Zone | .conf23 Getting in the zone is the key to operating at peak performance. At .conf23, we’d love to see you at our Success Zone with Splunk Education and Certification represented on the show floor to help you learn about learning. We’ll be on hand to share the portfolio of Splunk training coursework and how you can earn Splunk Certifications so you can use the Splunk platform at peak performance. With Splunk Education, you can learn your way, at your pace – anywhere, anytime – even on the Vegas Strip. Get in the Zone | Find us on the show floor Back to School | Splunk University is in Session Las Vegas is the place for learning in July! If you are headed to .conf23, consider coming into town early to attend one or more of over a dozen bootcamps. Our certified Splunk Education instructors will help you develop deeper expertise about Splunk products so you can better protect your team against threats, minimize downtime, and be ready to act when the unexpected happens. Splunk University will take place on July 15-17, and Thursday, July 20. Go to School | 3-day bootcamps Find Your Way | Learning Bits and Breadcrumbs Go to a Tech Talk | Deep-Dives for Technical Practitioners Go get swag | Use Learning Rewards Go for free | Get free training from a catalog of almost 40 courses Go social | LinkedIn for news Thanks for sharing a few minutes of your day with us – whether you’re looking to grow your mind, career, or spirit, you can bet your sweet SaaS, we got you. If you think of anything else we may have missed, please reach out to us at indexEducation@splunk.com. Answer to Index This: 888 + 88 + 8 + 8 + 8 = 1000 ... View more

New Splunk Learning Platform is Here We are excited to introduce you to the newest member of the Splunk Education family. Say hello to STEP. Log in today for a tour and to start a new learning journey. ... View more

A Vision for the Future of Cyber Did you know that the cyber skills gap has been estimated at 2 million to 3.5 million unfilled cybersecurity positions globally? Eric Fusilero, VP of Global Enablement and Education at Splunk and a panel of industry leaders share their ideas to address the gap.  Read the recap and watch the replay.   ... View more

Optimizing Your Observability Usage and Costs as You Scale with New Features from Splunk Learn how to leverage Splunk's new features to manage your metrics costs and usage. As organizations move to cloud-native technologies to improve speed and scale, they face new challenges related to data growth. Since 2010, the data we generate has increased exponentially, meaning more money is spent collecting, storing, and analyzing data. This makes it difficult to build a cost-efficient observability solution, meet performance at scale, and improve operational efficiency. To help with these challenges, Splunk has released new usage and cost controls for Observability Cloud users. Customers now have access to detailed MTS creation and usage analysis to better understand their metrics cardinality and how metrics are being used across teams and functions and identify opportunities for optimization. We’ve also released Metrics Pipeline Management within Splunk Infrastructure Monitoring, which offers users in-product, rule-based aggregation on MTS dimensions for easy MTS volume reduction. Increased Efficiency as You Scale What is Metrics Cardinality and How is it Impacting Your Observability Costs? Splunk Observability Cloud has introduced new usage and optimization controls to help customers manage the increasing metrics cardinality of their cloud-native environments and regain control of their data. Get Detailed Insight Into Your Metric Usage Analytics With Splunk Observability Cloud Customers can request an on-demand metric usage analytics report to understand the usage and cardinality of their metrics and optimize their metric time series in the system. Want to see more? Watch the Confidently Scale Your Observability Platform Without Scaling Costs Tech Talk | Play Now  How to Reduce TCO With Splunk Observability Cloud Splunk Observability Cloud offers Metric Pipeline Management that allows users to easily drop low value metrics and reduce their costs. Control Costs and Improve Performance Metrics Pipeline Management is a great way to help you maintain control of your metrics volume. It allows you to reduce your total cost of ownership by aggregating metrics to reduce your metrics volume. You can easily drop metrics that are not being used or aggregate high cardinality metrics, all in real time. Aggregated metrics also help boost your query performance. Metrics Pipeline Management is available to all Splunk Infrastructure Monitoring Enterprise customers or Standard customers who have Service Bureau Add-Ons. How to Use Metrics Pipeline Management Splunk Observability Cloud allows users to create configuration rules for metrics that need to be optimized, such as dropping data or setting aggregation rules, in order to utilize the data more efficiently. These powerful new tools offer simplified data management and improved performance. With the documentation and resources available, you can quickly get started with optimizing your observability usage and controlling costs.  Now Watch the Confidently Scale Your Observability Platform Without Scaling Costs Tech Talk | Play Now ... View more

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important logs are when it comes to troubleshooting and monitoring your tech stack. If you’re a Splunk platform customer, you’re already aware of the powerful logging capabilities that Splunk Cloud and Splunk enterprise provide. But did you know that you could also enjoy a no-code interface that combines logs, metrics and traces for faster troubleshooting of your application and infrastructure? That’s what Splunk Observability Cloud is all about! Splunk Platform and Splunk Observability Cloud Today, as ITOps and engineering teams, you need to proactively know how things are going, when to pay attention, what the dependencies are and how things are correlated across hybrid & multi-cloud environments. That’s where observability comes in, a practice used by software developers, platform engineers, site reliability engineers and ITOps practitioners to enhance business resilience and solve real business problems. With Splunk Observability, teams can overcome fragmented visibility, alert storms and incident guesswork to fix problems faster, improve reliability and build exceptional customer experiences.  As Splunk users, you don’t need another logging tool to be able to enjoy the benefits of observability. Our Splunk Cloud/Enterprise and Splunk Observability Cloud solutions share the same logs, so you only need to ingest them once to use them across products, teams and use cases.    Want to learn more ? Watch the Tech Talk | Play Logs in Splunk Observability Cloud You can easily query your logs from the Splunk platform via Log Observer Connect, and use them in Splunk Observability Cloud’s Log Observer, our no-code experience for searching, querying and analyzing logs data. Log Observer offers a unique interface drill down experience compared to Splunk Cloud. With it, you can access log data in the context of metrics and traces with Splunk APM and Splunk Infrastructure Monitoring, granting you a full overview of your data. Logs Timeline and Log Views are additional logging capabilities available in Splunk Observability Cloud that can help you make the most of your Splunk log investment and optimize your processes. Both of them allow you to combine your logs in a time-based chart with Splunk Infrastructure Monitoring’s real-time metrics in one single dashboard. Logs in dashboards’ trend display allows us to quickly spot any unusual activity in the data. The controls at the top allow us to change the time range and select the index to query. We can then add filters to find and identify related logs and perform quick root cause analysis. That way, next time you are troubleshooting and need to document your investigation or run log-based analysis to detect patterns or trends, you can just use logs views or logs timeline and add them to your customized dashboards.  Want to learn more ? Watch the Tech Talk! One Log To Rule Them All: Centralized Troubleshooting With Splunk Logs |  Play View Questions Asked During Live Q&A         ... View more

  February 2023 | Check out the latest and greatest     New capabilities provide deeper visibility and smarter alerting to troubleshoot faster You asked, we delivered. Splunk Observability Cloud has several significant new GAs and previews providing deeper visibility across your environments, and a unified approach to incident response. Now, receive deeper context from the end-user experience through your network and across every transaction, and bring order to on-call chaos with improved alert accuracy and automated scheduling, notification, and escalation capabilities.   Visibility across every user session and transaction, through the network: Several new capabilities help you solve problems faster with deeper visibility and more context across your tech stack and through to end-user experience. Whether you operate monolithic architectures or microservices, new Splunk capabilities provide context from your end user, through your cloud network, and throughout every transaction.   New capabilities include: Digital Experience Monitoring Application Performance Monitoring Infrastructure Monitoring and Logging Incident Management Click here for an overview of each capability   Try these Capabilities Today! If you’re already an Observability Cloud user you can get started today by following the links we’ve provided to documentation. For Splunk Cloud or Enterprise users, start an Observability trial today.     ICYMI: 4 Steps to 'Jump Start' Your Observability Journey with Splunk Observability to Modernize Apps and Increase Business Resilience Optimize Application Performance with Code Profiling Dos and Don’ts of Observability: Lessons Learned from RedMonk Can Your Cloud Migration Strategy Keep Up With the Speed of Business?     The .conf23 Call for Proposals is Open! If you’re thinking of submitting a Call for Speakers proposal, be sure to start here, with our .conf23 Call for Speakers Webinar. You’ll get tips, tricks and recommendations to help you prepare your .conf submission, directly from the .conf23 Review Committee and our speaker coach. You’ll learn: How to write a strong .conf title and abstract This year’s topics and themes to include in your learning objectives and overall submission Practical advice to help your .conf submission stand out and get you ready for a breakout stage Watch On Demand Now!     Lantern  This month we’re excited to announce the relaunch of the Splunk Success Framework, a comprehensive resource for Splunk program managers to create best-practice processes for Splunk implementation. This comprehensive framework has been updated to include a brand-new Fundamentals section, improved navigation, and fresh tips from Splunk experts. The four functional areas covered in the framework include program management, people management, platform management, and data lifecycle management. The best practices in the framework are flexible and modular, allowing you to tailor them to your organization's unique requirements. Check out the Splunk Success Framework today, and please let us know what you think!           Education Corner Free Exam Registration for O11y Beta Certification It might seem like secret code, but if you’ve been around Splunk for a while you know that O11y is short for Observability. If you’re ready to validate your skills in Splunk O11y Cloud, register for our certification exam now in beta and free for all candidates. As a beta, the Splunk O11y Cloud Certified Metrics User exam is a bit longer and the results will not be immediately available, however, the results are completely valid for those who pass. Find out more about Splunk Certification, the exams, and badges too!    There’s a Hero in All of Us! It’s time to envision the adventures you can have with more Splunk skills under your (utility) belt. It’s the Power of Splunk Education. How can data help you save the day?  Watch. The Power of Splunk Education See how learning to use the power of data through Splunk Education can help you become a super hero of your organization.           Talk to Splunk Product Design Our product design team is currently looking for Splunk users to talk to about their experiences with Splunk products. Sign up here to participate in upcoming studies and shape the future of our products and roadmaps!       Tech Talk: DevOps Edition Synthetic Monitoring: Not your Grandma’s Polyester! Seriously. We won’t pepper you with sales and marketing stuff; we’ll jump in and keep it technical! Join Splunk and TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk Synthetic Monitoring with real-world examples!     Until Next Month, Happy Splunking! ... View more

  February 2023  |  Check out the latest and greatest   Splunk Enterprise Security 7.1 Now Available The recent Splunk Enterprise Security (ES) 7.1 release helps tackle slow detection times, lack of context around security incidents, and inefficient implementation and execution of incident response flows. Learn more in this blog, and watch our demos on threat topology and MITRE ATT&CK framework features.     The .conf23 Call for Proposals is Open! If you’re thinking of submitting a Call for Speakers proposal, be sure to start here, with our .conf23 Call for Speakers Webinar. You’ll get tips, tricks and recommendations to help you prepare your .conf submission, directly from the .conf23 Review Committee and our speaker coach. You’ll learn: How to write a strong .conf title and abstract This year’s topics and themes to include in your learning objectives and overall submission Practical advice to help your .conf submission stand out and get you ready for a breakout stage Watch On Demand Now!     New Detections from the Splunk Threat Research Team The Splunk Threat Research Team (STRT) has had two releases of security content, which provide you with 18 new detections and 3 new analytic stories. The new security content is available via the ESCU application update process or via Splunk Security Essentials (SSE). The Splunk Threat Research Team has also published the following blogs to help you stay ahead of threats: All the Proxy(Not)Shells From Registry With Love: Malware Registry Abuses Introducing Splunk Attack Range v3.0   Using MITRE ATT&CK in Splunk Security Essentials The Splunk Security Essentials (SSE) app allows you to use the ATT&CK framework for a wide array of use cases and to answer a wide range of questions. Learn more in this blog.     Splunk App for PCI Compliance We recently released version 5.1 of the Splunk App for PCI Compliance to help solve financial compliance use cases by capturing, monitoring, and reporting on relevant data from any source to quickly investigate and resolve compliance issues. Learn more about the Splunk App for PCI Compliance here.     Splunk at Hackers on the Hill SURGe team member Mick Baccio recently attended Hackers on the Hill to hear from policy makers and experts on technology-related issues and get an overview on the National Cybersecurity Strategy. Learn more about his time at the event in this blog.     Purple Teaming to Enhance Detection Engineering Splunk Threat Research Team member Mauricio Velazco recently presented on a SANS Ask the Expert session highlighting the benefits of purple teaming and how the Splunk Attack Range can be used for purple teaming and detection development. Watch the recording  here.     Splunk Data Security Predictions 2023 If you missed SURGe team members Ryan Kovar and Mick Baccio presenting on the Splunk Data Security Predictions 2023 report live, be sure to check out the recording. The full report is available for Download here.   Lantern    This month we’re excited to announce the relaunch of the Splunk Success Framework, a comprehensive resource for Splunk program managers to create best-practice processes for Splunk implementation. This comprehensive framework has been updated to include a brand-new Fundamentals section, improved navigation, and fresh tips from Splunk experts. The four functional areas covered in the framework include program management, people management, platform management, and data lifecycle management. The best practices in the framework are flexible and modular, allowing you to tailor them to your organization's unique requirements. Check out the Splunk Success Framework today, and please let us know what you think!         Education Corner Splunk Training for All Meet Aspiring Cybersecurity Analyst, Marc Alicea  Splunk is expanding learning opportunities and lowering the barriers to entry for anyone, anywhere so learners can grow their careers and global organizations can find qualified candidates to fill the critical skills gap. This profile tells Marc’s story, an aspiring cybersecurity analyst, who completed 25 of our free, self-paced training courses on his journey to become a Splunk Core Certified User. It’s a real life depiction about one more learner who greatly benefited from our catalog of free Splunk Education courses available to anyone looking to grow their career and feel more confident navigating this highly-technical world.    There’s a Hero in All of Us! It’s time to envision the adventures you can have with more Splunk skills under your (utility) belt. It’s the Power of Splunk Education. How can data help you save the day?  Watch. The Power of Splunk Education See how learning to use the power of data through Splunk Education can help you become a super hero of your organization.           Talk to Splunk Product Design Our product design team is currently looking for Splunk users to talk to about their experiences with Splunk products. Sign up here to participate in upcoming studies and shape the future of our products and roadmaps!     Tech Talk: DevOps Edition Synthetic Monitoring: Not your Grandma’s Polyester! Seriously. We won’t pepper you with sales and marketing stuff; we’ll jump in and keep it technical! Join Splunk and TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk Synthetic Monitoring with real-world examples!     Until Next Month, Happy Splunking! ... View more

  February 2023  |  Check out the latest and greatest   Operationalized Data Science for Production Optimization: BMW Group Webinar Proactively identifying areas to improve the production process can be difficult, but by using data science models with Splunk you can derive deep insights from operations and optimize the production process. In this webinar, we share how the Splunk App for Data Science and Deep Learning (DSDL) is used by the BMW Group to accelerate the time to operationalize models in their production systems quickly allowing them to save costs, maximize productivity, and incease product quality.       How Can Analysts Address and Respond to Downtime, and Cyberthreats Quickly? IT and security analysts need to find incidents and cyberthreats easily and quickly. However, inconsistencies in data from different vendors makes it difficult. Data and source types aren’t all the same. So how can analysts address and respond to downtime, and cyberthreats quickly? Find out how the Common Information Model (CIM) can help in this e-book!     How To Optimize Costs and Data Value Using Splunk In this webinar, you can learn a strategic approach to data lifecycle management that will enable you to capture more value from your data AND optimize costs. Further, we will outline the key Splunk capabilities that enable organizations to achieve an ideal balance between data and cost optimization, and help you prove business value.     Building Bridges: Splunk Releases 2022 Global Impact Report Last month, Splunk released our second annual Global Impact Report, which shares our environmental, social and governance (ESG) progress, and advances impact work in our four key pillars of Global Impact — social impact, ethical and inclusive growth, data responsibility and environmental sustainability. Read the highlights in this blog or check out the full report.     The .conf23 Call for Proposals is Open! If you’re thinking of submitting a Call for Speakers proposal, be sure to start here, with our .conf23 Call for Speakers Webinar. You’ll get tips, tricks and recommendations to help you prepare your .conf submission, directly from the .conf23 Review Committee and our speaker coach. You’ll learn: How to write a strong .conf title and abstract This year’s topics and themes to include in your learning objectives and overall submission Practical advice to help your .conf submission stand out and get you ready for a breakout stage Watch On Demand Now!       Complimentary Copy of How to Decide When and How to Move Splunk to a Hybrid Cloud Environment For many enterprise organizations, the key to digital transformation lies in the speed, scalability and cost savings of the cloud. But not every organization can move completely to the cloud, for a wide variety of reasons.  Learn in this e-book why you should choose a Splunk hybrid environment and how Splunk Cloud Platform can make it easy to move to a hybrid cloud.     Lantern  This month we’re excited to announce the relaunch of the Splunk Success Framework, a comprehensive resource for Splunk program managers to create best-practice processes for Splunk implementation. This comprehensive framework has been updated to include a brand-new Fundamentals section, improved navigation, and fresh tips from Splunk experts. The four functional areas covered in the framework include program management, people management, platform management, and data lifecycle management. The best practices in the framework are flexible and modular, allowing you to tailor them to your organization's unique requirements. Check out the Splunk Success Framework today, and please let us know what you think!       Education Corner Cloudy with a Chance of Clarity Are you a new Splunk Cloud customer or administrator who could use a bit of guidance? Splunk Education offers some valuable courses designed to help provide clarity around using this new platform. The Splunk Cloud Administration hands-on, instructor-led course prepares administrators to manage users, get data in, and much more.  Register today.  Do you currently use Splunk Enterprise on-prem but are moving to Splunk Cloud? Well, we’ve got courses to help you with that too!  If you’ve previously completed Splunk Enterprise System Administration and Splunk Enterprise Data Administration, then check out the Transitioning to Splunk Cloud course. Register today.    There’s a Hero in All of Us! It’s time to envision the adventures you can have with more Splunk skills under your (utility) belt. It’s the Power of Splunk Education. How can data help you save the day?  Watch. The Power of Splunk Education See how learning to use the power of data through Splunk Education can help you become a super hero of your organization.         Talk to Splunk Product Design Our product design team is currently looking for Splunk users to talk to about their experiences with Splunk products. Sign up here to participate in upcoming studies and shape the future of our products and roadmaps!     Tech Talk: DevOps Edition Synthetic Monitoring: Not your Grandma’s Polyester! Seriously. We won’t pepper you with sales and marketing stuff; we’ll jump in and keep it technical! Join Splunk and TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk Synthetic Monitoring with real-world examples!     Until Next Month, Happy Splunking! ... View more

  January 2023 New Product Releases   Splunk Network Explorer for Infrastructure Monitoring Splunk unveils Network Explorer, a new feature integrated within the Infrastructure Monitoring solution designed to bring network-level visibility to cloud-native environments. With this new capability, SRE and developers can finally get full visibility into their Kubernetes environment to better monitor their cloud and microservices and troubleshoot faster.   Incident Intelligence Public Preview Splunk Incident Intelligence public preview is now available! An incident response solution, Splunk Incident Intelligence connects IT and DevOps teams handling on-call responsibilities to the data they need to diagnose, remediate, and restore services before customers are impacted. This is available to all Splunk Observability Cloud suite and a la carte product customers. With the introduction of Splunk Incident Intelligence to Splunk Observability Cloud we are the only observability vendor to offer infrastructure, application, and digital experience monitoring with AIOps and incident response capabilities in one unified experience. ICYMI Dos and Don’ts of Observability: Lessons Learned from RedMonk Can Your Cloud Migration Strategy Keep Up With the Speed of Business? DevSecOps: The What, Why, Who, and How New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster     FREE Observability eLearning Courses Help You Up-Skill with Splunk Splunk can give you the superpowers you need to save the day. Our latest survey shows that the strongest superheroes up-skill with Splunk Education. That’s why we are making Splunk training easier and more accessible than ever. Get started today with these Observability self-paced, free eLearning courses. Result Modification This three-hour course is for power users who want to use commands to manipulate output and normalize data.  Register  Working with Time This three-hour course is for power users who want to become experts at using time in searches.  Register  Getting Data In This 2-hour introductory course is designed for anyone who wants to use the Splunk Distribution of the OpenTelemetry (OTel) Collector to send metrics and logs to Splunk Observability Cloud, including basic troubleshooting during setup.  Register Statistical Processing This three-hour course is for power users who want to identify and use transforming commands and eval functions to calculate statistics on their data.  Register Creating Knowledge Objects This three-hour course is for knowledge managers who want to learn how to create knowledge objects for their search environment using the Splunk web interface.   Register Creating Field Extractions This three-hour course is for knowledge managers who want to learn about field extraction and the Field Extractor (FX) utility.  Register Enriching Data with Lookups This three-hour course is for knowledge managers who want to use lookups to enrich their search environment.  Register Data Models This three-hour course is for knowledge managers who want to learn how to create and accelerate data models.  Register Introduction to Splunk Synthetic Monitoring Learn what Splunk Synthetic Monitoring is, explore the UI and differentiate the types of tests. Register     Cloud Customers Add your “Security Contact” Today for Cybersecurity-based “Data Breach” Legal Notices We work hard to protect your data. In the event of a data breach incident, we need to act fast and be confident we’re communicating with the right people. Good news, we’re making it easy for you to add and manage this through our new “Security Contact” feature. Please take a few minutes to add one or more individual emails or email aliases as your Security Contact(s) through the Customer Portal. Learn more here.       Talk to Splunk Product Design Our product design team is currently looking for Splunk users to talk to about their experiences with Splunk products. Sign up here to participate in upcoming studies and shape the future of our products and roadmaps!         Lantern Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, Product Tips, and Data Descriptor articles. This month we’re sharing a swathe of new articles written by fantastic Splunk partners. We’re also requesting help from Splunkers and partners to help us write articles on a range of hot topics requested by Splunk customers. If you’re a Splunker or partner with expertise to share, we’d love to hear from you!  Read on to find out more.       Education Register for a FREE Certification Exam, Now in Beta Are you ready to validate your knowledge of all-things-Observability? Then you’ll be happy to know that we have a New Splunk Certification: Splunk O11y Cloud Certified Metrics User. Registration for this new Certification exam is open NOW in beta.  As a beta, this exam is FREE for all candidates, is a bit longer, and the results are valid for those who pass,  but the results will not be available until May or June. If you feel ready and qualified for the challenge, practice for the exam using the test blueprint and register for a free exam appointment. All the details can be found on the Splunk Registration Page on the Website.       Splunkbase Did you join the recent Builder Tech Talks on getting the most out of the new Splunkbase user interface? If not, you can watch the replays and join the discussion in the Splunk Community.  With the new year come lots of new and updated apps in Splunkbase! Or maybe you want to see what’s popular among Splunk customers. Take a look and try a new app!   Community We are Happy to Share the Newest Updates in Splunk Cloud Platform 9.0.2209!  Analysts can benefit from faster troubleshooting, enhanced drill-down capabilities, streamlined viewing of Dashboard Studio and Classic dashboards on Splunk Mobile with a scannable QR code for each dashboard that automatically registers users and displays the dashboard on their mobile device, etc.  Admins can benefit from easier configuration with a user interface to directly set specific stanzas, improved security management with the ability to limit which domains can import images on their dashboards, etc. Read the blog post for more details! Tech Talks | Now On Demand Security Edition: Fusing Intelligence into Splunk SOAR | Watch Now Platform Edition: Splunk Cloud Platform Migration Lessons Learned | Watch Now   Until Next Month, Happy Splunking! ... View more

January 2023   Splunk Security Essentials (SSE) 3.7.0 Release The free Splunk Security Essentials (SSE) 3.7.0 app was released in early December and includes some great new updates: The ability to push MITRE ATT&CK and Cyber Kill Chain attributions to the ES Incident Review Dashboard Metrics and visualization on how many data sources are enabled from corresponding originating apps The ability to search for content using free text in Content Mapping Learn more about these new updates and more in our blog, and download SSE to get started today. Tech Talks: Security Edition | Now On Demand   Machine Learning in Security   Splunk customer Saudi Aramco recently presented on how their organization uses the analytical power of Splunk to hunt for cyber and insider threats and how they also utilize the Splunk Machine Learning Toolkit (MLTK) for novelty and outlier detection. View the recording here.   Fusing Intelligence into Splunk SOAR     Watch this session to learn how Splunk® Intelligence Management ingests, normalizes and prioritizes intelligence from over 70 sources to simplify Splunk® SOAR playbooks. Watch Now   Essential Guide to Risk-based Alerting   This new guide shows how risk-based alerting in Splunk Enterprise Security can reduce the number of overall alerts while increasing the fidelity of alerts that do arise. Download your copy here, and watch this video to see a demo of how to work with risk-based alerts in Splunk Enterprise security.   Detections & Analytics from the Splunk Threat Research Team The Splunk Threat Research Team (STRT) has had three recent releases of security content in the Enterprise Security Content Update (ESCU) app, with the most recent being v3.55.0. These releases delivered 29 new detections and 6 new analytic stories, which are all available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). The Splunk Threat Research Team has also published the following blogs to help you stay ahead of threats: Detecting Cloud Account Takeover Attacks: Threat Research Release, October 2022 From Macros to No Macros: Continuous Malware Improvements by QakBot Inside the Mind of a ‘Rat’ - Agent Tesla Detection and Analysis CISA Top Malware Summary   Splunk Data Security Predictions 2023 Splunk security experts have provided their take on the threats and strategies that will define 2023. Download your copy here and register to join SURGe team members Ryan Kovar and Mick Baccio for the webinar Staying Cyber Resilient in 2023.   Splunk Named a Leader for SIEM and Security Analytics Platforms Splunk is proud to have been named a leader in two recent analyst reports. Read more and download the reports from our blogs: Splunk Named a Leader in the Forrester WaveTM: Security Analytics Planforms, Q4 2022 Splunk Named a Leader in the 2022 IDC MarketScape for SIEM   Finding Value in Macro-level ATT&CK Reporting Knowing that security teams are feeling overwhelmed by the increasing number of attacks on their network, SURGe (Splunk’s strategic cybersecurity research team) recently analyzed three years of macro-level ATT&CK trends across public and private data sources to gain insight into what attackers are doing and to help inform defensive planning. Read the blog to learn more about this research.   Explore the Splunk SOAR Adoption Maturity Model We recently created an in-depth white paper to help SOC teams lay out a security orchestration, automation and response (SOAR) maturity journey using the SOAR Adoption Maturity Model. Read the blog or download the white paper to learn more.     Cloud Customers Add your “Security Contact” Today for Cybersecurity-based “Data Breach” Legal Notices We work hard to protect your data. In the event of a data breach incident, we need to act fast and be confident we’re communicating with the right people. Good news, we’re making it easy for you to add and manage this through our new “Security Contact” feature. Please take a few minutes to add one or more individual emails or email aliases as your Security Contact(s) through the Customer Portal. Learn more here.     Talk to Splunk Product Design Our product design team is currently looking for Splunk users to talk to about their experiences with Splunk products. Sign up here to participate in upcoming studies and shape the future of our products and roadmaps!       Lantern Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, Product Tips, and Data Descriptor articles. This month we’re sharing a swathe of new articles written by fantastic Splunk partners. We’re also requesting help from Splunkers and partners to help us write articles on a range of hot topics requested by Splunk customers. If you’re a Splunker or partner with expertise to share, we’d love to hear from you!  Read on to find out more.     Education Register for a FREE Certification Exam, Now in Beta Are you ready to validate your knowledge of all-things-Observability? Then you’ll be happy to know that we have a New Splunk Certification: Splunk O11y Cloud Certified Metrics User. Registration for this new Certification exam is open NOW in beta.  As a beta, this exam is FREE for all candidates, is a bit longer, and the results are valid for those who pass,  but the results will not be available until May or June. If you feel ready and qualified for the challenge, practice for the exam using the test blueprint and register for a free exam appointment. All the details can be found on the Splunk Registration Page on the Website.   Until Next Month, Happy Splunking! ... View more

  January 2023 Peace on Earth and Peace of Mind With Business Resilience All organizations can start the new year with peace of mind if they prioritize business resilience. Ensuring your business and systems are secure, available and resilient is critical for a successful year of blooming business. Not sure where to start? We’ve been working all year long to make sure you’re prepared, protected and able to bounce back. Learn how in this blog post.       2022 Splunk Product Review 2022 felt like it went by in a flash. Checkout the highlights of product and feature innovations we released this past year, with a spotlight on the over 80 Splunk Ideas portal enhancements delivered at the suggestion of our user community.       Dashboard Design: Visualization Choices and Configurations New year, new dashboards? Learn how to level up your dashboards with our two part dashboard design blog series. In Part 1, we reviewed dashboard layout design and provided some templates to get started. In this Part 2, we’ll be walking through various visualization types and the best ways to configure them for your use case, and explain the best visualization color palette types to effectively communicate your story.     Cloud Monitoring Console You’ve probably heard of Workload Pricing, our cloud pricing model which is based on the workloads you run against the data ingested into Splunk. But how do you get the most out of Workload Pricing? Through the Cloud Monitoring Console, or CMC! Tune in to this video to learn how the CMC gives you visibility and control into how your compute capacity is used.     What’s New with Splunk Augmented Reality (AR) Splunk AR enables your workforce to access live data while working on field assets. This enables quicker troubleshooting on the job, and allows technicians to repair issues on the first try, saving companies valuable time and money. This past year at .conf22, we announced a powerful new set of features for Splunk AR, along with we also announced the launch of Splunk AR for Android Private Preview. We’re also announcing that the Splunk Edge Hub and Splunk AR now have a joint Splunkbase app. Let’s dive in!   IDC Report A Best Practice Blueprint from Customers on Successful Cloud Migration Moving to the cloud requires planning, well-defined processes, data conversations, and a clear vision for business outcomes. Managing hybrid and multi-cloud adds more to the complexity. In the IDC report, "What Makes a Cloud Migration Successful? A Best Practice Blueprint from Customers," IDC along with two large organizations offer best practices and recommendations for migrating self-managed Splunk Enterprise deployments to Splunk Cloud Platform efficiently to increase agility and security, empower innovation and accelerate return on investment realization. To learn more visit Splunk Cloud Platform Migration   Cloud Customers Add your “Security Contact” Today for Cybersecurity-based “Data Breach” Legal Notices We work hard to protect your data. In the event of a data breach incident, we need to act fast and be confident we’re communicating with the right people. Good news, we’re making it easy for you to add and manage this through our new “Security Contact” feature. Please take a few minutes to add one or more individual emails or email aliases as your Security Contact(s) through the Customer Portal. Learn more here.   Talk to Splunk Product Design Our product design team is currently looking for Splunk users to talk to about their experiences with Splunk products. Sign up here to participate in upcoming studies and shape the future of our products and roadmaps!     Lantern Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, Product Tips, and Data Descriptor articles. This month we’re sharing a swathe of new articles written by fantastic Splunk partners. We’re also requesting help from Splunkers and partners to help us write articles on a range of hot topics requested by Splunk customers. If you’re a Splunker or partner with expertise to share, we’d love to hear from you!  Read on to find out more.   Education Register for a FREE Certification Exam, Now in Beta Are you ready to validate your knowledge of all-things-Observability? Then you’ll be happy to know that we have a New Splunk Certification: Splunk O11y Cloud Certified Metrics User. Registration for this new Certification exam is open NOW in beta.  As a beta, this exam is FREE for all candidates, is a bit longer, and the results are valid for those who pass,  but the results will not be available until May or June. If you feel ready and qualified for the challenge, practice for the exam using the test blueprint and register for a free exam appointment. All the details can be found on the Splunk Registration Page on the Website.   Splunkbase Did you join the recent Builder Tech Talks on getting the most out of the new Splunkbase user interface? If not, you can watch the replays and join the discussion in the Splunk Community.  With the new year come lots of new and updated apps in Splunkbase! Or maybe you want to see what’s popular among Splunk customers. Take a look and try a new app!   Community We are Happy to Share the Newest Updates in Splunk Cloud Platform 9.0.2209!  Analysts can benefit from faster troubleshooting, enhanced drill-down capabilities, streamlined viewing of Dashboard Studio and Classic dashboards on Splunk Mobile with a scannable QR code for each dashboard that automatically registers users and displays the dashboard on their mobile device, etc.  Admins can benefit from easier configuration with a user interface to directly set specific stanzas, improved security management with the ability to limit which domains can import images on their dashboards, etc. Read the blog post for more details!   Tech Talks Now On Demand Security Edition: Fusing Intelligence into Splunk SOAR | Watch Now Platform Edition: Splunk Cloud Platform Migration Lessons Learned | Watch Now   Until Next Month, Happy Splunking! ... View more

  November 2022   2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a Row Splunk is thrilled to announce that we have been named a Leader in the 2022 Gartner Magic Quadrant for Security Information and Event Management. Learn more about the innovations in Splunk Enterprise Security over the last 12 months in this blog or download the full report from Gartner here. You can also read more about key SIEM capabilities and features in our blog “Six SIEM Essentials for Successful SOCs.”   Detections & Analytics from the Splunk Threat Research Team The Splunk Threat Research Team (STRT) has had two recent releases of security content in the Enterprise Security Content Update (ESCU) app. The most recent being v3.52.0, which includes 27 new detections and 4 new analytic stories. These detections are now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Highlights from both releases include: An update to the Splunk Vulnerabilities analytic story that contains 6 new detections for the latest CVEs published by Splunk in the Quarterly Security Patch Updates on November 2nd, 2022. Several new detection analytics that help you detect unusual activities that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. A new detection for Text4Shell (CVE-2022-42889), a new critical vulnerability similar to the old Spring4Shell and Log4Shell. An advisory analytic story to assist defenders with CISA AA22-277A, which was recently released by the Cybersecurity and Infrastructure Security Agency (CISA) in response to an advanced persistent threat (APT) that utilized Impacket, an open-source toolkit, and other common techniques. Updated content based on feedback and simulated attack data related to ProxyNotShell, which is a continuation of the ProxyShell saga but requires valid credentials. Additional content for the Cloud Account Takeover use case with four new analytics that help detect attacks against Multi-factor Authentication (MFA) defense mechanisms for Amazon Web Services (AWS) console and 6 new analytic stories to help detect GCP Account Takeover. The Splunk Threat Research Team also published the blog “Dark Crystal RAT Agent Deep Dive,” which highlights Splunk analytics developed for that Remote Access Trojan (RAT) to help you identify signs of compromise within your network.   Splunk App for Fraud Analytics To help combat the continued rise in Fraud, the Splunk App for Fraud Analytics provides an anti-fraud solution that integrates with the detection and investigation power of Splunk Enterprise Security. Learn more about the app in our recent blog “Detect Fraud Sooner with the Splunk App for Fraud Analytics.”   InfoSec App for Splunk Have you heard of the InfoSec App for Splunk? It can be used as your security starter pack to address some of the most common security use cases. Learn more in our recent blog “Splunk Security with the Infosec App.”   Federated Search for Security Earlier this year, Splunk introduced Federated Search, which allows users to leverage Splunk search, alerting and dashboarding capabilities for data across multiple, disparate Splunk deployments. Federated Search can also be used to enable security use cases. Learn how you can make the most of Federated Search for security in this blog.   Security Events Splunk delivered a lot of great security information in the past month. In case you missed them, here are the on demand Tech Talks and webinars: Tech Talks: Splunk Attack Range: Build Simulate, Detect Purple Teaming - Build, Attack, and Defend Your Organization Responding to risk notables at machine speed using automation  Webinars: Future of Security Operations Centers (or read the highlights and get the related report in this blog) ML in Security: Risky SPL Detection with MLTK SOC, Amore Mio! Following .italo’s Tracks to a More Mature SOC   Understanding Zero Trust with AWS and Splunk Achieving a comprehensive zero trust policy involves a range of integrated components and requires an ecosystem approach. Read our new white paper to learn how to align zero trust methodologies with AWS Services through Splunk’s ecosystem of applications.   Splunk Honored with Five TrustRadius Best Software Awards Splunk got more great news this month, and we are excited to be the recipient of five “Best Software” awards from TrustRadius. Splunk Enterprise Security (ES) won awards for Best Software for Enterprise, Best Software for Mid-Sized Businesses, and Best Software for Small Businesses. Splunk SOAR won awards for Best Software for Enterprise, and Best Software for Mid-Sized Businesses. To learn more about the TrustRadius awards, check out the blog. You can also leave your own review here.   Education Corner Over 20 FREE eLearning Courses Help You Up-Skill with Splunk Splunk can give you the superpowers you need to save the day. Our latest survey shows that the strongest superheroes up-skill with Splunk Education. That’s why we are making Splunk training easier and more accessible than ever with more than 20 self-paced, free eLearning courses. Start with foundational courses like Intro to Splunk or dive into more advanced courses like Search Under the Hood, Visualizations, and many more. Enroll today so you have the skills to detect the good, the bad, and the unproductive. Oh, and you can stand out as a data superhero with Splunk swag! If you are one of the first 500 learners to complete three or more unique FREE eLearning Courses between 11/14/22 - 1/31/23, you’ll be entered into a drawing for a chance to win $100 to spend on Splunk t-shirts, socks, water bottles, and so much more! Terms and Conditions apply.   Community Ongoing Blog Series on OpenTelemetry: Use OpenTelemetry to Auto Instrument WordPress  OpenTelemetry is often associated with modern microservices and cloud-native applications. What happens if we apply OpenTelemetry and modern observability techniques to something completely different? WordPress is the world's most popular weblog software. And it's also an almost 20 years old monolith. What happens if we use OpenTelemetry auto tracing and the Splunk Observability cloud? Imagine you are responsible for running WordPress sites. What insights can we bring with modern tools to a popular monolith? Just by instrumenting the environment, without any changes to the WordPress code. Read the blog post to learn about this process step-by-step!     Do More with Lantern The Lantern team are excited to announce that we have partnered with Splunk’s OnDemand Services team on a live chat feature to help you solve problems in real-time. The chat system connects you instantly to one of our OnDemand experts, who can help with the specifics of articles, as well as connect you to other ways you can get help. This initial trial of our chat feature is only available until Friday, November 18, so hop onto Lantern today and test it out with your most urgent Splunk implementation questions. Read about this and see all our latest articles in our monthly blog.   Find an App with Splunkbase It’s been over a month since the new Splunkbase released as the default experience. Thanks for the supportive feedback you have given! We hope that in addition to using the improved search engine you are also following the Trending Apps on Splunkbase and the New Splunk Built and Supported Apps sections just down the home page. Currently trending are the popular Splunk Add-on for Microsoft Windows and the Splunk Add-on for Unix and Linux. And with the new month comes a new update of the Splunk ES Content Update  with lots of new and updated security insights.     ... View more

  November 2022   Skill Up on Splunk with our New Builder Tech Talk Series Can you build it? Yes you can! *play the Bob the Builder song* Our newest series of Tech Talks is focused on builders - from users who create dashboards and extend the platform with Splunkbase add-ons to advanced builders who develop their own custom apps. In this series, dashboard builders can learn methods to more efficiently create dashboards within Splunk Cloud Platform and Splunk Enterprise 9.0, and how to make them more performant while using fewer search resources. Discover how to get even more from Splunk using Splunkbase add-ons and apps to tackle expanding security, ITOps, AIOps, and DevOps use cases and more. App builders can learn how to use the new Splunk Cloud Developer Edition to test and validate custom apps for cloud readiness. Sign up for one, some, or all of the Builder Tech Talk series today!     Splunk Assist: Cloud-Powered Insights for Your Enterprise Deployment We’re excited to introduce a new release of Splunk Assist! If you missed the buzz about Splunk Assist® we’ll fill you in: it’s a cloud-connected service for Splunk Enterprise that allows you to monitor your deployment and see recommendations to improve your security posture. Assist does this by providing the following: Active monitoring: No need to hunt for critical security gaps Actionable insights: No need to look for docs and tutorials to fix issues as you go Powered by the cloud: Continuous improvements at your doorstep mean no need to keep up with version upgrades and security patch upgrade Security first: Data isolation and authentication best practices This release allows customers to activate Assist with the click of a single button. Check out this blog to learn more about Splunk Assist.     Introducing the Splunk App for Data Science and Deep Learning 5.0 The Deep Learning Toolkit App for Splunk (DLTK) will be renamed the Splunk App for Data Science and Deep Learning (DSDL). It’s slightly lengthy, but a better-suited name because the app is useful for both deep learning and data science operations. Not only is it getting a new name and new features - The Splunk App for Data Science and Deep Learning 5.0 is officially a “Splunk Supported” app. This means that customers can resolve issues quickly by filing a case with the confidence they’ll be supported after downloading the app. Learn more in this blog. A Deeper Dive Into Machine Learning at Splunk We’ve been thinking long and hard about how we can help offer more prescriptive introductions into using ML at Splunk and I’m pleased to present our set of MLTK deep dives. These build on some of the content presented at recent webinars, such as the one on how to prevent data downtime with machine learning. The purpose of the deep dives is to provide end-to-end guides for how to implement specific use cases against your own data in Splunk, so if you are looking for inspiration over where to get started with ML you need not look any further than this blog! Upcoming Events Builder Tech Talk Series Check out these 30 minute Tech Talks. Join us and learn how to build and customize Splunk for any use case. December,1 | Streamlined Dashboard Building: Productivity Tips and Tricks. Register January,10 | How to get Value Quickly from the New Splunkbase User Experience. Register January,17 | Understanding DevOps Pipeline Analytics with Splunkbase Apps. Register January, 24 | Building Your Own Security Solution with Splunkbase Apps. Register January, 31 | Splunk Cloud Developer Edition. Register   Now On Demand Improving Dashboard Performance and Resource Usage. Watch The Developer's App Starter Kit. Watch Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs. Watch Simplifying Your Data with Splunk and Google Cloud Platform. Watch Splunk Assist: Cloud-Powered Insights at Your Fingertips. Watch   Splunk Quarterly Advisories Customers are at the center of everything we do at Splunk and security is our top priority. We are committed to helping customers identify and remediate security issues quickly, and plan to provide advisories and patches for any vulnerability considered “Critical” or “High” risk as close to real-time as possible. For vulnerabilities that are considered “Moderate” or “Low” risk, we’re planning quarterly releases so that Splunk administrators can plan for patches and upgrades on a predictable schedule. On November 2, Splunk published thirteen Security Advisories regarding potential vulnerabilities related to Splunk Enterprise and Splunk Cloud Platform. Please review our FAQ for answers to the most commonly asked questions for the November advisories. We plan to publish quarterly updates on the first Tuesday of each Splunk fiscal quarter. The next three anticipated dates are: February 7, 2023 May 2, 2023 August 1, 2023 Education Corner Over 20 FREE eLearning Courses Help You Up-Skill with Splunk Splunk can give you the superpowers you need to save the day. Our latest survey shows that the strongest superheroes up-skill with Splunk Education. That’s why we are making Splunk training easier and more accessible than ever with more than 20 self-paced, free eLearning courses. Start with foundational courses like Intro to Splunk or dive into more advanced courses like Search Under the Hood, Visualizations, and many more. Enroll today so you have the skills to detect the good, the bad, and the unproductive. Oh, and you can stand out as a data superhero with Splunk swag! If you are one of the first 500 learners to complete three or more unique FREE eLearning Courses between 11/14/22 - 1/31/23, you’ll be entered into a drawing for a chance to win $100 to spend on Splunk t-shirts, socks, water bottles, and so much more! Terms and Conditions apply. Community Ongoing Blog Series on OpenTelemetry: Use OpenTelemetry to Auto Instrument WordPress  OpenTelemetry is often associated with modern microservices and cloud-native applications. What happens if we apply OpenTelemetry and modern observability techniques to something completely different? WordPress is the world's most popular weblog software. And it's also an almost 20 years old monolith. What happens if we use OpenTelemetry auto tracing and the Splunk Observability cloud? Imagine you are responsible for running WordPress sites. What insights can we bring with modern tools to a popular monolith? Just by instrumenting the environment, without any changes to the WordPress code. Read the blog post to learn about this process step-by-step!   Do More with Lantern The Lantern team are excited to announce that we have partnered with Splunk’s OnDemand Services team on a live chat feature to help you solve problems in real-time. The chat system connects you instantly to one of our OnDemand experts, who can help with the specifics of articles, as well as connect you to other ways you can get help. This initial trial of our chat feature is only available until Friday, November 18, so hop onto Lantern today and test it out with your most urgent Splunk implementation questions. Read about this and see all our latest articles in our monthly blog. Find an App with Splunkbase It’s been over a month since the new Splunkbase released as the default experience. Thanks for the supportive feedback you have given! We hope that in addition to using the improved search engine you are also following the Trending Apps on Splunkbase and the New Splunk Built and Supported Apps sections just down the home page. Currently trending are the popular Splunk Add-on for Microsoft Windows and the Splunk Add-on for Unix and Linux. And with the new month comes a new update of the Splunk ES Content Update  with lots of new and updated security insights.   ... View more

  October 2022 Highlights   Splunk Observability Cloud New Data Management Center for Splunk Observability Cloud The new Data Management page provides more visibility into what integrations have already been set up to your account and advanced data configuration tools that can help you optimize the data coming into Observability. The new UI should provide faster access management and maintenance of your account. Splunk Infrastructure Monitoring Changes to Dimension Values for AWS CWAgent Namespace Splunk Infrastructure Monitoring collects telemetry from AWS CloudWatch to inform users regarding the status of their cloud services and alert customers in the case of failures or degradation of service. Customers can use the Amazon CloudWatch Agent to provide detailed performance data on EC2 compute instances. Splunk is changing the format of the AWSUniqueId dimension on resources in the CWAgent namespace to ensure that value is aligned to the AWSUniqueID for the EC2 namespace. Aligning the AWSUniqueId values simplifies merging metrics from the two services to present a more complete view of the resource. This change will cause new data from those instances to be mapped to a different MTS than legacy data. No interruption of data is expected, however when this change is rolled out to each integration it is possible detectors using this data which rely on historical continuity will temporarily behave differently.  ICYMI Why You Need Synthetic Monitoring SignalFlows to SLOs New Features in the Content Pack for Monitoring and Alerting See how Splunk is your code-to-cloud visibility partner Splunk is a proud Platinum sponsor at KubeCon North America. Swing by our booth P6 to learn all about Observability Cloud, OpenTelemetry, and test your skills on our McLaren Racing Simulators. Learn More Tech Talks   You're invited Join the Splunk Threat Research Team on Tuesday, October 25, 11am PT / 2 pm ET for a demo of Splunk Attack Range v2.0. They’ll discuss: How the Splunk Threat Research Team leverages the Splunk Attack Range The newest features available in the Splunk Attack Range v2.0 Future plans for Splunk Attack Range v3.0 Register to Attend   Now On Demand Platform Edition The Developer’s App Starter Kit | Watch Now Observability Edition Introducing Log Observer Connect: Powering Observability with Splunk Cloud Platform Logs | Watch Now View More Tech Talks   Do more with Lantern  It's been a busy month for Splunk Lantern, with a host of fresh new Getting Started Guides, use cases and product tips that have been added to our site.  We’ve also launched a new feedback widget! You can now use the orange tab on the left-hand side of our pages to tell us how articles are working for you, or where improvement is needed. Please take the time to leave feedback on our articles so we can make sure our content is effective in helping you succeed with Splunk. Check out our Community Blog to learn more!   Find an App with Splunkbase Have you seen the new Splunkbase? It’s a whole new user experience with faster and better search results, more detail in the app listings, and app collections focused on use cases that drive value! Now you can easily find the apps that are trending in the community, or see which apps have the highest ratings from users. Want to try our hand-curated collections of apps? Check out the Staff Picks, try Getting Started with Security, improve your Threat Detection and Response, consider Getting Started with ML, and get visibility of your Pipeline Analytics for DevOps.   Education Corner  Splunk Education has been working hard behind-the-scenes to prepare our Splunk 9.0 platform training release. The first 9.0 courses were released late September and we will continue to roll out updated training content in the coming weeks and months. Splunk Administrators who will be administering Splunk 9.0 should definitely check out the upgraded versions of Splunk System Administration and Splunk Data Administration with expanded content and new Q&A slides. Stay tuned for more exciting news in the months to come about an expansion to our free training offerings and (maybe) even a new certification in early 2023!     ... View more

  October 2022 Highlights   What’s New in Splunk Cloud Platform 9.0.2208?! Read our community post to check out the newest capabilities and updates in the new release of Splunk Cloud Platform. These include the much-anticipated “dark mode” and improved security from jQuery 3.5, which is now set as default with older jQuery libraries restricted. Online Learning: A Novel Approach to Applying Machine Learning in Splunk     In this blog, learn how to organize your machine learning model in a new way: online learning. Understand the difference from batch learning, the best use cases, and how you can use the Splunk App for Data Science and Deep Learning (formerly DLTK). Improving Security: Updates to Classic Dashboards Containing External Links or Content At Splunk we are continuously working to improve security and prevent incidents. As part of this commitment to security, we want to ensure you have a chance to review and verify external content or links in Classic (Simple XML) dashboards, and you will now see a modal requesting you to review and determine whether you trust the external content or link. In this blog, we'll cover the scenarios in which you will see a modal, and what actions you can take. Top 5 Reasons Splunk is the Ideal Platform for Unified Security and Observability   Splunk embodies the top 5 principles of unified security and observability, and has been an expert in log management, security, and observability for years. While there are many point solutions for either security or observability, the world's leading brands trust Splunk to deliver a unified platform for not only security and observability, but also the ability to customize to meet their unique, enterprise-scale business needs. In this blog, explore each of the top five principles of unified security and observability and how Splunk helps customers succeed because of them. Top 5 Challenges in Data (and What You Need to Do About Them) In the Data Age, it’s no secret that data volume and velocity are continuing to grow exponentially. To get a handle on your data, you will need to prioritize it according to frequency of use and importance to the business. But before you begin, you will also need to understand some of the biggest data challenges — and learn to navigate around them. Read our newest E-Book on the "Top 5 Challenges in Data” to learn how to overcome five of the biggest obstacles to your data strategy you might encounter. The Data Tiering Playbook: A Value-Based Approach to Data Access Learn how to create a sustainable data tiering framework aligned to your data strategy that will help you extract the most business value from your data. In this step-by-step guide, you will learn: The benefits and challenges of getting started on a data tiering initiative. How to prioritize your data into categories. How to effectively implement a data tiering framework that generates ROI for your organization over the long term. Tech Talks   You're invited Join the Splunk Threat Research Team on Tuesday, October 25, 11am PT / 2 pm ET for a demo of Splunk Attack Range v2.0. They’ll discuss: How the Splunk Threat Research Team leverages the Splunk Attack Range The newest features available in the Splunk Attack Range v2.0 Future plans for Splunk Attack Range v3.0 Register to Attend   Now On Demand Platform Edition The Developer’s App Starter Kit | Watch Now Observability Edition Introducing Log Observer Connect: Powering Observability with Splunk Cloud Platform Logs | Watch Now View More Tech Talks Do more with Lantern  It's been a busy month for Splunk Lantern, with a host of fresh new Getting Started Guides, use cases and product tips that have been added to our site.  We’ve also launched a new feedback widget! You can now use the orange tab on the left-hand side of our pages to tell us how articles are working for you, or where improvement is needed. Please take the time to leave feedback on our articles so we can make sure our content is effective in helping you succeed with Splunk. Check out our Community Blog to learn more! Find an App with Splunkbase Have you seen the new Splunkbase? It’s a whole new user experience with faster and better search results, more detail in the app listings, and app collections focused on use cases that drive value! Now you can easily find the apps that are trending in the community, or see which apps have the highest ratings from users. Want to try our hand-curated collections of apps? Check out the Staff Picks, try Getting Started with Security, improve your Threat Detection and Response, consider Getting Started with ML, and get visibility of your Pipeline Analytics for DevOps. Education Corner  Splunk Education has been working hard behind-the-scenes to prepare our Splunk 9.0 platform training release. The first 9.0 courses were released late September and we will continue to roll out updated training content in the coming weeks and months. Splunk Administrators who will be administering Splunk 9.0 should definitely check out the upgraded versions of Splunk System Administration and Splunk Data Administration with expanded content and new Q&A slides. Stay tuned for more exciting news in the months to come about an expansion to our free training offerings and (maybe) even a new certification in early 2023! ... View more

  October 2022 Detections & Analytics from the Splunk Threat Research Team The Splunk Threat Research Team recently released Enterprise Security Content Update v3.50.0 with 19 new detections and 4 new analytic stories. Release highlights include: A new type of analytic that leverages the Splunk App for Data Science and Deep Learning to detect DNS connections to domains generated by Doman Generation Algorithms. A new analytic story called Okta MFA Exhaustion and updated analytic story Suspicious Okta Activity with 8 new detections in response to the recent successful attacks to Uber, CloudFlare and Cisco that abused MFA push spam against Okta as a common technique. The Splunk Threat Research Team also published a blog for defending against the new exploitation tool Brute Ratel. New content includes analytic stories featuring detections of related malicious payloads, a Yara rule, and details on how to use Splunk SOAR to defend against this threat. Bingo! 10 Security Standards in 2022 You Can’t Live Without: RSA Top-Rated Session Follow-up If you had a chance to watch the original top-rated RSA 2022 session with Kirsty Paine and Bret Jordan, tune in for an exclusive follow-up where they share new insights since the presentation was delivered and answer questions from viewers on October 26th. This session will not be recorded or available on demand, so be sure to register today. Webinar Join Patrick Coughlin (GVP Security Portfolio Market Strategy at Splunk) and Mike Rothman (General Manager at Techstrong Research) for a fireside chat in which they dive into the current security landscape, the evolution of security tooling, the benefits of a data-centric approach to security, and predictions on the state of SOCs over the next five years. Click here to register ML in Security: Risky SPL Detection with MLTK Join Splunk Machine Learning experts Greg Ainslie-Malik, Abhinav Mishra, and Kumar Sharad as they dive into specific examples of how the Splunk team is using ML to detect risky SPL and how it relates to the Machine Learning Toolkit (MLTK). Click here to register. You can also read more about ML-based detections to help find users running highly suspicious SPL commands in this blog from the Splunk Threat Research Team. .conf22 Breakout Sessions Available On Demand If you weren’t able to attend .conf22 in June this year, all breakout sessions are now available for viewing online. Browse hundreds of sessions, but here are a few of our favorite security sessions to get you started: Curating Your Risk Ecology: Making Risk Based Alerting Magick (SEC1144C) A Beginner’s Guide to SOAR: Automate 5 Basic Security Processes in Under 30 Minutes (SEC1304C) Build Detection as Code Like the Splunk Threat Research Team (SEC1197C) Splunk SOAR + SIEM: An Automation Powerhouse for Cyber Incident Response (SEC1676B) Tech Talks You're invited Join the Splunk Threat Research Team on Tuesday, October 25, 11am PT / 2 pm ET for a demo of Splunk Attack Range v2.0. They’ll discuss: How the Splunk Threat Research Team leverages the Splunk Attack Range The newest features available in the Splunk Attack Range v2.0 Future plans for Splunk Attack Range v3.0 Register to Attend   Now On Demand Platform Edition The Developer’s App Starter Kit | Watch Now Observability Edition Introducing Log Observer Connect: Powering Observability with Splunk Cloud Platform Logs | Watch Now View More Tech Talks Do more with Lantern  It's been a busy month for Splunk Lantern, with a host of fresh new Getting Started Guides, use cases and product tips that have been added to our site.  We’ve also launched a new feedback widget! You can now use the orange tab on the left-hand side of our pages to tell us how articles are working for you, or where improvement is needed. Please take the time to leave feedback on our articles so we can make sure our content is effective in helping you succeed with Splunk. Check out our Community Blog to learn more! Find an App with Splunkbase Have you seen the new Splunkbase? It’s a whole new user experience with faster and better search results, more detail in the app listings, and app collections focused on use cases that drive value! Now you can easily find the apps that are trending in the community, or see which apps have the highest ratings from users. Want to try our hand-curated collections of apps? Check out the Staff Picks, try Getting Started with Security, improve your Threat Detection and Response, consider Getting Started with ML, and get visibility of your Pipeline Analytics for DevOps. Education Corner  Splunk Education has been working hard behind-the-scenes to prepare our Splunk 9.0 platform training release. The first 9.0 courses were released late September and we will continue to roll out updated training content in the coming weeks and months. Splunk Administrators who will be administering Splunk 9.0 should definitely check out the upgraded versions of Splunk System Administration and Splunk Data Administration with expanded content and new Q&A slides. Stay tuned for more exciting news in the months to come about an expansion to our free training offerings and (maybe) even a new certification in early 2023! ... View more