Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can benefit from: Dashboard Studio email exports, the new ability to schedule email exports from the Actions dropdown. Related Content linking Splunk Cloud Platform with Splunk Observability Cloud, the new ability to preview Splunk Observability Cloud infrastructure and application data related to an event investigated in the Splunk Cloud Platform Search and Reporting UI. Admins can benefit from: Field Filtering to limit access to confidential information by redacting or obfuscating fields in events within searches, with optional role-based exemptions. New ability to enable Okta as an IDP to automatically de-provision deactivated users in Splunk. Access to Ingest Actions on Splunk Cloud Platform for Google Cloud, including ‘filter’ ‘mask’ and ‘set index’ capabilities.  An improved Federated Search experience allowing customers to turn on/off a federated provider and an improved Data Scan Unit (DSU) consumption experience when running fixed parameter settings with absolute time filters. Enhanced Search Telemetry for Subsearches enabling Splunk support and engineers to more quickly diagnose and resolve issues related to subsearches. Check out the full release notes for more details. Python 2 is in the process of deprecation and soon will no longer be available in coming releases. jQuery v3.5 library is now set as the platform default; prior jQuery libraries are no longer supported. ... View more

Splunk is pleased to announce the latest enhancements to Edge Processor that will help to optimize your data management needs to filter, mask, and route more intelligently. These include support for Lookups, RawHec and Cryptographic Functions. Enhanced HEC capability, now with RawHEC: To complement the earlier release of data ingest and export using HTTP Event Collector (HEC,) Splunk Edge Processor can now receive events via a raw HEC endpoint.  Third-party cloud services can send data to Splunk without having to conform to a Splunk specific format or account for the inability to change code formats with an authentication token. That means you can push more data into Splunk, at a high bandwidth, and with control over data schema. To learn more, check out Splunk Docs. Enhanced Masking with Cryptographic Functions: Support for cryptographic functions builds on the masking capabilities in Edge Processor, and are necessary to ensure data integrity and confidentiality before it leaves your network boundaries. Where previously you could only redact data using Edge Processor, now you can hash data of your choosing, and perform analytics on top of it. For example, you might hash sensitive data like a credit card number before that data streams to Splunk platform; and you may still want to know how many transactions happened using that credit card over the past month. Now you can generate new insights and value into your data. New Lookups: Edge Processor now delivers support for Lookups that enables users to perform better data enrichment and in turn, to make more informed decisions about the data before its indexed.  This means that you can now identify which device failed but not in the event rather saved in another file. You can now erich data further up in the pipeline before indexing to accelerate detection, and you can append information to an event and write an event as an original event, without having to do additional research. For more about Splunk Edge Processor, including plans to support additional sources, destinations, and new functionality, see release notes and documentation.  And be sure to join the Slack user group #edge-processor to get real-time support from the Community.  ... View more

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can benefit from: Updates to the data sets UI to improve the overall usability and accessibility  Dashboard Studio improvements:  New ability to conditionally show or hide panels in Grid layout New option to select Dashboard Studio when saving reports to dashboards Admins can benefit from: Zero downtime upgrades for SHC Victoria stacks, allowing search continuity for short and long-running searches during upgrades and rolling restarts New Workload Management rules with a predicate search_time_range to reduce the impact of searches over large amounts of data Decentralized search telemetry collection, increasing efficiency, integrity (completeness), and reliability of search telemetry while freeing up Search Head capacity Improved role based security for every search using Access Control List (ACL)  An update to Splunk Secure Gateway to allow turning on/off mobile notifications for Alerts and Reports and resizing of the SSG opt-in window enabling mobile users to opt-in from their mobile device during login Private Connectivity now available for Splunk Cloud Platform search capabilities and UI access over private endpoints through AWS PrivateLink for PCI, HIPAA, IRAP, and GovCloud offerings Check out the full release notes for more details. Python 2 is in the process of deprecation and soon will no longer be available in coming releases. jQuery v3.5 library is now set as the platform default; prior jQuery libraries are no longer supported. ... View more