The Background Five years ago Splunk published several videos showcasing members of the SplunkTrust(tm) to share their story and passion for the Splunk community. As it is currently application-season (now through May 5th, 2023!), we are revisiting featured SplunkTrust members to see where they are now.  Rich Mahlerwein was the star of a .conf17 video when he was a Senior Information Systems Security and Database Architect with Forest County Potawatomi Community. Watch his video to get to know Rich: Are you interested in becoming a member of the SplunkTrust? Know a peer that would be a great fit? Read this blog for more information about the process, and feel free to utilize the nomination and application forms. Where is SplunkTrust member Rich Mahlerwein now? Rich Mahlerwein, aka @Richfez on Splunk Answers and the Splunk community Slack, is currently a Director Of Operations with Splunk partner Sideview, LLC. We interviewed Rich for this Where Are They Now series of posts to share his career growth story with you. Read on to learn more about Rich since his video was released.   How has your career changed since you started working with Splunk products? When the video was made I worked for the Forest County Potawatomi Community, and the job was a lot of systems administration and Splunk was rejuvenating to use. I enjoyed providing the Splunk Documentation team with feedback as I used the product more, and I received a Document Feedback Champion trophy. I also got more involved in the Splunk community and became a member of the SplunkTrust. I was at that job for 11 years and thought it was time for a change. I knew Nick Mealy, the founder of Sideview, LLC, from the Splunk community, as we had collaborated on a few things. I took a role with Sideview, and now I work for a Splunk partner instead of being a customer.  How has your usage of Splunk changed with the new role? At the Forest County Potawatomi Community we had a cute Splunk environment. It was like a road between two sizes; it wasn’t giant, but we used a lot of enterprise features. Now I’m at a company that has just two full-time people, so I wear a lot of hats. Our usage of Splunk is focused around the development and support of our Cisco CDR Reporting and Analytics app. I interact with customers a lot — that’s probably the most fun and is really bizarre to me because of being an introvert. We’re always willing to jump on a call with our customers to help with the app, and it is fun to step out into other areas of Splunk and help them with any Splunk questions they might have. Are there any projects that you are particularly proud of with your recent work? I think I’m just proud of most everything I do. Something I was just finishing up right now is making sense of one IT vendor’s data model and defining the fields in Splunk. Puzzling through the documentation, the database, and actually making sense of the places where the vendor is wrong. So maybe I am just proud I haven't lost that skill. I enjoy being the grease in between what ought to be and what is. That's the driving force behind me; I like to see other people happy while doing things I can help them do better.  You’re still involved in the Splunk community and a member of the SplunkTrust.  What areas of the community do you focus on now? I still do a lot of things with Splunk docs. I helped run the most recent Splunk BSides along with Clara Merriman, and that has been really important. Splunk BSides originally grew from the hallway conversations people would have when attending .conf events, and we wanted to bring more technical content to the conference in an underground-community way. Those efforts convinced Splunk that we needed a dedicated SplunkTrust track at the conference. Family was a big focus of your video. How is your family doing? Well, we still go kayaking, although it's usually not when there's still ice on the lake. Evey presented at the .conf18 BSides about regular expressions, and she now insists she has forgotten everything. Maddie is a freshman and starting to think about her long-term plan. Both Evey and Maddie are driving now. My wife, Colette, is getting back into IT. Thank you for your time, Rich! We appreciate everything you do as a member of the SplunkTrust and your contributions to the Splunk community! Thank you for being you! If you would like to learn more about the SplunkTrust program then read this blog for more information about the process.  You can utilize the nomination form to refer a peer to the SplunkTrust program, and the application form to apply to the program yourself. ... View more

In 2018, Splunk published several videos showcasing members of the SplunkTrust to share their story and passion for the Splunk community. It is currently application-season for the SplunkTrust through May 5th, 2023, and we are revisiting featured SplunkTrust members to see where they are now. Are you interested in becoming a member of the SplunkTrust? Do you know a peer that would be a great fit? Read this blog for more information about the process, and utilize the nomination and application forms.   This week we are showcasing SplunkTrust member Clara Merriman. When Clara’s video was published, she was a Business Intelligence Engineer for SONIFI Solutions: Where is SplunkTrust member Clara Merriman now? Clara Merriman, aka @cmerriman on Answers and the Splunk community Slack, is currently an Observability Services Manager at Splunk. You may also recognize Clara from her Clara-fication series of blog posts and .conf presentations. We interviewed Clara for this Where Are They Now series of posts to share her career growth story with you. Read on to learn more about Clara since her video was released.   The first question I have is how is your dog, Sadie? She was featured in your video, and I know how much you love her! Sadie’s awesome. She has had quite the year, though.  She got scratched by a cat in her eye, had a couple of surgeries for that, a staph infection, and a lip infection. She’s had a year, but she is really good!  She loves the snow, and when I shovel the driveway I take her out with me and she jumps in the air like a dolphin to try and catch the snow I throw for her. Also, she loves that I work from home, and if I don’t go into my office by around 8am she just sits in the office staring out of the door at me.   You’ve had quite the journey the past five years since the video was published.  Tell me a bit about your path to where you are now. When the video was shot, I was a Business Intelligence Engineer. I loved it. The data was just so fascinating. I got a job at Splunk in 2018 as a Splunk Engineer on the team that is responsible for Splunk at Splunk. They were excited for the things I did as a Business Intelligence Engineer and wanted to bring that kind of skill set over. I moved from South Dakota to California at that time. I lived in San Jose, and I would share time between our San Jose and San Francisco offices. Sadie also loved it when she could tag along to the San Francisco office.  During all of this time, my skills have developed from Business Intelligence to IT to Security. What type of work did you do as a Splunk Engineer at Splunk? I was helping run an internal Splunk deployment, but at the time it was for everyone in the company. We supported marketing, sales, IT, security - you name it. It was sort of one stack even though there were multiple search clusters. It was kind of a cluster of an architecture, but it worked. We eventually improved on this when we migrated to Splunk Cloud Platform. At SONIFI we had a single search head & indexer, so there was a learning curve. I didn't know much about clustering or deployment servers, or anything like that. So it's a huge learning curve, and it was exciting. After about a year or so I was promoted to a Senior Splunk Engineer.   In addition to your internal Splunk work, you are also well known for your Clara-fication blog posts and .conf sessions.   The Clara-fication stuff has been super fun. I need to get back to the blog posts, but the .conf sessions are a change of format for me to share knowledge. I have a bunch of topics for the blog that I have started, and I just need to find the time to finish them. A lot of people recognize me at .conf events because of my pink wig. SplunkTrust member Martin Müller and I are working together again this year on a session for .conf23 that will be interactive instead of just a breakout. I have a couple of other sessions at .conf23 as well - come check them out!   You recently were promoted again to Observability Services Manager. Tell me a bit about that. I’ve had three different positions at Splunk, and the career development has been amazing for me. I am now the manager of the Splunk team that I was working on after the previous manager took a new role. I know where I want to go, and I try to tailor my work and education around that so I can be as successful as possible in my role and throughout my career development. Currently we have a heavy security focus, and we are starting a center of excellence in security. It’s going to be really exciting to be a part of something so impactful.    What is some recent work that you are really proud of? With the focus on security, our team has begun rolling out RBAC policies and the configurations to support that. My team is doing a talk on this topic at .conf23, and I’m excited for them to share their work. Over the past year or so we started doing more automation, utilizing Terraform and GitLab pipelines. We are able to automatically deploy RBAC configurations and are going to work on better index management automation.   Thank you for your time, Clara! We appreciate everything you do as a member of the SplunkTrust and your contributions to the Splunk community. Thank you for being you! We will publish additional Where Are They Now posts over the next weeks leading up to May 5th, 2023 when the nomination and application forms close for SplunkTrust       If you would like to learn more about the SplunkTrust program then read this blog for more information about the process.  You can utilize the nomination form to refer a peer to the SplunkTrust program, and the application form to apply to the program yourself. ... View more

  tl;dr - SplunkTrust Nomination and Application Forms are open for the .conf23 cohort selection. Nominate a peer or apply yourself by May 5th, 2023. The SplunkTrust are community or self-nominated individuals recognized annually that share a passion for helping their peers find success with Splunk by sharing their insights, experience, and domain-specific knowledge. We are so thankful of the generous community contributions made by members of the SplunkTrust. Being chosen as a member of the SplunkTrust is not about how much Splunk you know; Splunk’s training and certifications already confirm a person’s Splunk knowledge. Instead, selection for the SplunkTrust program is about a person’s involvement in the Splunk community. Do you lead one of our global Splunk user groups? Are you one of the top contributors to our community website? Are you a respected presenter at our Splunk events? Are you an app builder on Splunkbase? These are some of the areas that members of the SplunkTrust regularly contribute to strengthen the Splunk community. The first SplunkTrust cohort was inducted at .conf2015, and this year’s selection will be inducted at .conf23. Selected SplunkTrust members do not have to attend .conf23 to be part of the program, and existing members need to re-apply. What makes a great SplunkTrust nominee or applicant? A member of the Splunk Community website A passion for helping peers succeed with Splunk A year or more of participation in the Splunk community High engagement in multiple areas of the Splunk community, or significant engagement in a single area Benefits of being a member of the SplunkTrust Free pass to .conf23 Splunk EDU Credits Access to private SplunkTrust areas of the community Quarterly SplunkTrust virtual events Are you or someone you know a fit for the SplunkTrust? Then apply or nominate them!  Submission forms will be open through Friday, May 5th 2023 11:59:59pm PDT. If you would to apply for the SplunkTrust: Submit your application using the Application Form Ask your peers to submit nominations about you using the Nomination Form We will let you know when your application has been received If you would like to nominate a peer: Submit your peer using Nomination Form Encourage others to nominate your peer, too! We will reach out to the nominee and ask them to apply so they know they are part of the process   Act fast and submit your nomination or application to be part of this amazing program. We look forward to welcoming new members to the SplunkTrust and recognizing their contributions to the Splunk community at .conf23. ... View more

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of the Splunk community that have shown consistent participation in at least one area of our community programs. The Splunk MVP program is one way the community team recognizes our star contributors, and it complements the SplunkTrust program, which has been in place for many years. The Splunk community is built upon the efforts of its members and the contributions they make to help their peers find success. We are always thankful for your contributions!   Starting with this cohort, Splunk will recognize community members twice a year based upon community program participation. This first cohort was selected based upon participation in the Splunk Answers forums and our top Splunk User Group leaders, and we are adding additional sources for Splunk MVP recognition from our other community programs in upcoming selection rounds.   How do I become a Splunk MVP? Chances are, you’re already well on your way! Splunk MVP selection will focus on community contributions, prioritizing engagement and support, in whatever areas you might be most passionate about. Do you love answering questions about Splunk SOAR in Splunk Answers? That’s one way! Driving fabulous engagement as a leader of your Splunk User Group? That’s another way! Rockin’ out the Slack contributions? Yep, that could definitely score you an invite! Are you contributing some amazing technical content to our community blogs? Yep, even that. The beauty of this tier is that it can help recognize stand-out contributions in even a single area. Twice each year, we’ll review your contributions alongside specific selection criteria (sorry, the specifics are secret to help avert gaming the system!), and we’ll send special invitations to community members that qualify.    Introducing our first cohort of Splunk MVPs: Thank you to the following people for your Splunk community contributions. Our programs are built around your knowledge of Splunk, domain expertise, and passion to help your peers find success:   Brett Adams Ryan Adler Gareth Anderson Michael Bentley John Billings Johnny Blizard Steven Bochniewicz Mika Borner Antony Bowesman Doug Brown Becky Burwell Shawn Cannon Suat Celikok Siddhartha Chakraborty Douglas Clendening Mary Cordova Aleem Cummins Giuseppe Cusello Kamil Damuc Dustin Eastman Eric Favreau Mhike Funderburk Suman Gajavelly Rich Galloway Lakshmanan Ganesan Javier Garcia Nieva Alain Giammarinaro Adam Gold Björn Hansen Dustin Hoffmann Oliver Hoppe John Huang Vatsal Jagani Dal Jeanis Rohit Joshi Nancy Kafer Pavan Kalyan Chris Kaye Steve Koelpin Greg Kollias Tom Kopchak Matthias Kowalewski Mariusz Kruk Charles Kuykendall Yuan Liu Alex Lu Robert Lynch Rich Mahlerwein Nick Mealy Manjunath Meti Madison Moss Martin Müller Renjith Nair Shivansh Nautiyal Christopher Owen Cary Petterborg Nate Plamondon Ryan Plas Gregory Rivas Shawn Routhier Trevor Scroggins Nadine Shillingford David Shpritz Diogo Silva Michael Simko Kulwinder Singh Kyle Smith Somesh Soni Ismo Soutamo Daniel Spavin Vijay Sri S George Starcher Sekar Sundaram Balaji Thambisetty Andrew Trobec Matt Uebel Michael Uschmann Kamlesh Vaghela Dominique Vocat Duane Waddle Colby Williams Tom Wise Yutaka Yamada Srikanth Yarlagadda Chris Younger Andre Zeemering   To those who aspire to be an MVP, keep up the good work! Remember, there are many ways to contribute and make an impact in the Splunk community, and we want to recognize the diverse talents and skills of our members. We look forward to recognizing more members twice a year.    Congratulations once again to the first cohort of Splunk MVPs. ... View more

Announcing Splunk User Groups: Plugged-In For over a decade Splunk User Groups have helped their local Splunk users find success and provide networking opportunities for the attendees. We are excited to announce a new program for 2023:  Splunk User Groups: Plugged-In. Connect with your local community and Splunk experts, charge up your Splunk knowledge, and share your valuable experience with your peers! The Plugged-In program allows user group leaders to hold a bespoke event experience fully sponsored by Splunk. We want to help our user group leaders solve the common challenges they have, such as sourcing technical content and growing their chapter membership. Splunk User Group leaders will be holding Plugged-In events throughout 2023, and we don’t want you to miss out on any of the great content and fun!  It doesn’t matter if you’re new to Splunk or a veteran, we will partner with leaders of qualified user groups to create an event for you. Keep an eye out for any upcoming Plugged-In events with the Splunk user group chapters of which you are a member.   When will a Plugged-In user group event happen near me? Become a member of your local Splunk user group to be notified of any events, including any upcoming Plugged-In events. Will these be in-person, virtual, or hybrid events?  A Plugged-In event could be either of these. Your user group leader will partner with the Splunk Community Team to create a great event for your chapter. Why should I join my local Splunk User Group? Because they’re fun! Splunk User Groups provide geo-based options for you to connect with peers, learn the latest technologies, and dive deep into all-things-Splunk. Members come from all kinds of industries, companies, and backgrounds, ranging from novice to expert levels. Connect with others in your local Splunk community to collaborate and share ideas!     Questions? Contact the Splunk Community Team at usergroups@splunk.com ... View more

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The survey is all about your experience with community.splunk.com. We are launching the survey to better understand how valuable a resource the community platform is to Splunk users. Your responses will help us identify opportunities to improve the community platform experience. If the survey appears for you, please take a few moments to complete it. We truly appreciate all feedback. Please keep in mind that the survey will appear only on occasion. After completing the survey, you should not see it again for at least a month. If you frequently clear cookies from your browser, the poll may appear more often than usual as it's cookie-based. If you have any questions or comments, please respond to this post. Thank you for being a part of the Splunk community! The Splunk Community Team ... View more

TL;DR - We are recognizing your growing contributions and leadership in our community with a new MVP program alongside the SplunkTrust. We are delighted to announce the launch of our new Splunk Community MVPs program, which will sit alongside our existing SplunkTrust program. The SplunkTrust will always recognize the best, set the highest standard, and be our most elite MVP-style program, recognizing our top contributors across all community areas; our new Splunk Community MVPs will join our MVP programs to recognize and reward a broader collection of top contributors in each community area. Once upon a time, there was a fez. And the fez was brilliant; the fez was inspiring; the fez represented our SplunkTrust… our most esteemed and most contributing community leaders. The first cohort of 22 members were inducted at .conf2015, and the most recent cohort of 69 members were inducted at .conf21. We are proud to continue to recognize and reward our highest and most esteemed community of valuable contributors with our SplunkTrust program, and the fez will always signify these members across our community spaces. With all respect and praise to the fez… when we look across these programs and spaces, we can’t help but notice hundreds of community members standing out and stepping up. The fact is, our Splunk Community has grown and flourished in so many fabulous ways. In just the last two years, we’ve launched a new technology platform for Community, a new platform for User Groups, and welcomed the Community Slack workspace (finally!) into the fold of official programs. Splunk has also continued its own meteoric rise and growth with new products, new solutions, and even new companies as part of the growing family. And so it makes sense that we’ve seen thousands of new customers and new community members join our programs in recent years. Amidst all of the growth - across Splunk and across our Splunk Community - we  wanted to say that… WE SEE YOU! We see SO many of you posting, engaging, solving, and contributing in even more diverse and numerous ways. In fact, YOUR growth has been so tremendous that we feel we simply must recognize and reward even more of you for this! So while our SplunkTrust will always remain as our most elite program, we’re so stoked to have it be joined by this new one, welcoming and recognizing so many more. How do I become a Splunk Community MVP? Chances are, you’re already well on your way! This program looks across all areas of community contributions, prioritizing engagement and support, in whatever areas you might be most passionate about. Do you love answering questions about Splunk SOAR in Splunk Answers? That’s one way! Driving fabulous engagement in your Splunk User Group? That’s another way! Rockin’ out the Slack contributions? Yep, that could definitely score you an invite! Are you contributing some amazing technical content in our blogs and Tech Talks? Yep, even that. The beauty of this tier is that it can help recognize stand-out contributions in even a single area, and it will recognize hundreds of members overall. Twice each year, we’ll review these kinds of contributions alongside specific selection criteria (sorry, the specifics are secret to help avert gaming the system!), and we’ll send special invitations to community members that qualify. What are the perks and responsibilities as a Splunk Community MVP? Why should I say “yes”? As an MVP, the expectations are few, and the rewards are many. First, if invited, we hope you’ll continue engaging in the ways you have been or look to grow them even more. We want to provide you the limelight and recognition with a special community badge, upgraded permissions, featured content contributions, and of course… some rad swag. We ask that MVPs continue to be culture carriers of our Splunk community ideals, lead by example to bolster the community, and participate in advocacy opportunities to highlight their successes with Splunk. Benefits Asks Public recognition with your MVP badge Upgraded community permissions Inclusion in our private MVP community areas Featured contributions in community blogs  Educational perks and learning opportunities MVP sneak peeks for product news & more And of course... AWESOME SWAG! Keep doing what you're doing! (Contribute and lead by example!) Attend at least one quarterly MVP meeting (or watch the recap) every six months Participate in one Splunk Love advocacy activity every six months    Keep engaging and keep an eye on your inbox! Again, participation is totally optional, but if you meet the criteria and receive an invite, and if you want to join the program, we’d love to have you! So keep up the great community engagement, and you might receive that special invitation very soon. We can’t wait to introduce you to our first group of Splunk Community MVPs! -- Jason Hupka (a.k.a. "snooplogg"), Sr. Community Trust & MVP Manager ... View more

tl;dr: SplunkTrust Nominations and Applications are open now through Aug 25th! Nominate a peer for the SplunkTrust with this form; and/or apply for your own spot with this form. It’s That Time of Year! Knowledge is great... but helping is even better! Are you a rock-star-helper-outer in our community? Or have you seen a few exemplary members helping others? Now is the time to recognize and reward our most helpful and contributing community members by considering them for our SplunkTrust MVP program.  Nominating Someone for the SplunkTrust... Annually since 2015, Splunk has selected exemplary members of the Splunk community to join the SplunkTrust. Any community member can nominate their peers for selection in the program, and community members may also apply for a spot themselves.   What makes a great submission? We’re not looking for people who know the most about Splunk; we already have training and certifications to reflect that knowledge. We look for people who are passionate about helping their peers be successful using whatever Splunk & domain knowledge they have.  If you know of someone who represents these values, use this form to nominate them. We’ll make sure any nominees have an opportunity to apply before the deadline. In your nomination, be sure to tell us how they have helped you, or others, to be successful, and other community-supporting accomplishments.  Applying for the SplunkTrust... Do you feel you fit these values? Or were you recently nominated and want to formally apply? Let us know by using this form to apply yourself. Tell us about yourself, your community-focused accomplishments, and encourage your peers to submit nominations on your behalf. We love celebrating the exceptional members of our Splunk community.     About the Selection Process This year's SplunkTrust selection process will include four phases:  1. Submission, 2. Analysis, 3. Hammer Fight, and 4. Induction. 1. Submission Each candidate, whether nominated by someone else or applying themselves, must complete their own application. We plan to accept applications through Wednesday, August 25th, 2021. There are no limits to how many nominations you can submit, and there are no limits on the quantity of applications we will consider. So nominate often!  2. Analysis We'll compile all applications and enrich them with data from various community platforms and programs (Splunk Answers, User Groups, Community Slack, and more). We also ask existing members to help rate applicants,  and all of this information is provided to the members involved in Hammer Fight so they may review applicants prior to the final selection. 3. Hammer Fight Over a dozen Splunk employees gather for an hours-long meeting to discuss all of the applicants and determine the new SplunkTrust cohorts. Hammer Fight is the colloquial name given to this final selection process. We don’t recall exactly when the name Hammer Fight became associated with this, and there are no hammers or fighting actually involved in the process 😀.   4. Induction Last, and most excitedly, is notifying and welcoming next year's cohorts. Selected members will be notified mid-September of their status. At .conf21 we will have an induction ceremony to welcome the members of the SplunkTrust and provide them with a fez. Selected members do not need to attend .conf21 in-person or virtually. So... you have a few short weeks to nominate your peers or apply yourself, and I really hope you do both! Because the only thing better than being an exemplary, passionate, and helpful member of our community is doing it in a stylish new fez! In Fez We Trust, Jason Hupka, Sr. Manager and Principal Trust Wrangler P.S. Questions are welcome! Just comment below! Here are a few of the more common questions I hear... FAQ I’m a Splunk expert, so can I be on the SplunkTrust? Remember, selection is not based on what you know, but how you help others with whatever you know. I am already a SplunkTrust member. Do I need to re-apply? Yes - the SplunkTrust cohort is selected annually so you must re-apply Do I need to attend .conf21 if I am selected for the SplunkTrust? No - you do not need to attend .conf21 if selected. We do have an induction ceremony at the conference, but you do not need to be present to accept the honor. What is the airspeed velocity of an unladen swallow? African or European? How many SplunkTrust members do you select? We do not have a set number of membership slots for the program. When will I know if I have been selected for the SplunkTrust? We plan to notify all applicants the week of September 16th, 2021 of their status.   ... View more

Has anyone ran Splunk on an Intel Compute Stick like the CS125? How does it perform versus the CS325 or CS525? I'm curious to hear any stories from the trenches on how a Search Head or Universal Forwarder worked on them. Thanks! 🙂 ... View more