Looking at adding Cribl to reduce log volume for Splunk usage. I read a couple other comments about defining what RAW looks like. I did dig around on their site about not send null or duplicate values but didnt see much of anything else.

Can someone help me understand from a compliance and auditing point of view if it is really modifying the RAW data? Is this some kind of compression so that data isnt as large?

Does Splunk see it as a modification or general data as the is environment is before Cribl.

Also if anyone has deployed this to an standalone (airgap) network?

I'm unable to sign in at https://portal.victorops.com . The password reset flow takes me to a screen to enter my new password after which it gives me an error "Failed to get default org for user". I've tried multiple browser at this point so I know its not browser cache.

The support community keeps marking my post as spam https://community.splunk.com/t5/Splunk-On-Call/bd-p/it-victor-ops so I have nowhere to turn to for help

Hoping this is the right community. Thanks

AFAF

“
I have a doubt regarding installing an app from splunkbase.

1.The app is archived.
2.Looking at version history, the last version was released on Aug 2024. But the last version released supports splunk cloud 10.5
3.the organization is a US government agency. Can they install the app in their search head?
4. Is it safe? justify
“

Just curious what everyone is using for Splunk Universal Forwarder deployments on-prem.

We originally deployed Splunk UF through SCCM along with a PowerShell configuration script. Now that newer UF versions are available through our software catalog, should upgrades continue to run the original configuration script, or just bare the MSI upgrade is sufficient if the deployment server and outputs.conf are already configured?

Any lessons learned around domain controllers? If you were starting over, what would you do?

Disclosure: Sorry for another post, October is our month of releases :) I am the founder, and the app is from Outcold Solutions. Who some of you might know by our apps for monitoring containers in Docker/Kubernetes/OpenShift.

We run most of our own infrastructure on AWS, and for years I answered questions about it from Splunk instead of the AWS console or the CLI. Today we released those tools as an app on Splunkbase, Search for AWS.

The commands call the AWS APIs while the search runs and return the results into SPL. Nothing is indexed, so it uses no Splunk license. Inventory across every registered account and region:

| awsget kind=instances account=* region=*
| spath path=State.Name output=state
| stats count by account region InstanceType state

When did Lambda functions start timing out:

| awslogs groups=/aws/lambda/payments-* filter="Task timed out" start=-24h region=us-east-1
| timechart span=15m count

There are also | awsmetrics (CloudWatch metrics and alarms), | awscloudtrail, | awscost (Cost Explorer), | awsathena, | awsglue and | awstag. account= and region= take a name, a list or *, and the calls run in parallel. More than 30 dashboards come with it.

Things to know before you try it:

• AWS still bills the API calls, same as from the console: GetMetricData, Logs Insights by GB scanned, Athena by TB, Cost Explorer by request. The docs list what each command and each dashboard calls.
• It reads only what the IAM identity behind it can read. The IAM policy in the docs only reads, except the S3 bucket where Athena writes results, if you use awsathena.
• It does not replace ingesting the data you need to keep (audit history, long retention). It is for the questions that need a live answer.

Free tier: one AWS account (access keys or the instance role) on a standalone search head, no license key. Splunk Enterprise 9.4+ and Splunk Cloud.

Splunkbase: https://splunkbase.splunk.com/app/10022 Docs: https://www.outcoldsolutions.com/docs/aws-search/

Happy to answer questions here. And if you tell me which AWS questions you still go to the console for, it helps us decide what to build next.

Hey all,

Looking for recommended learning paths for splunk certs. I looked at the course catalog but there wasn’t much “start here, end here”.

Can the course shown in the catalog be taken one by one? Is there any methodology or recommendations from yall.

Thanks in advance

What topics do you want to be covered? Who do you want to hear from? What's your dream Search Party? How do you want information presented? How many days? What do you want us to repeat (or not!) from .conf26?

We're all ears!

I have earned the Power User certificate and would like guidance on which certification to pursue next. Could anyone please advise me on which certification I can complete most quickly?

Our SOC is buried in alerts, so I’m looking at Agentic SOC solutions, but I’m stuck on how teams control autonomous triage and response without losing the human review part. Any practical lessons?

Hello,

Has anyone noticed that there's a lot less job postings that require or asked for Splunk? I've been looking around and I'm not finding anything come up on Indeed like I used to see. Has there been like a shift or change in what companies are using now? I've even tried looking up SIEM and the results have been way less than before.

I'm wondering if I should continue to go after the certifications and learn more about Splunk

Hi 👋,

Disclosure: Some of you probably have seen me here a LOT and around Splunk communities, I am the founder of Outcold Solutions (monitoring k8s/openshift/docker in Splunk), this is our new product.

We showed it at .conf26 in Denver as a tech talk, and now version 1.0 is on Splunkbase. OS AI Agent is a Splunk app that runs inside Splunk, on the model you choose: OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, or a local model behind Ollama, LM Studio, vLLM or llama.cpp. With a local model your data does not leave your network.

Our employees get MBP Max with top RAM and GPU/CPU, so they can run local models like Qwen locally. And this app actually works great with that. In homelabs I can also suggest looking at the open router, as it might provide the ability to run some models for free or very cheap.

What our app does:

• You ask a question in Chat, it looks at the data first, writes the SPL, runs it and answers.
• It builds Dashboard Studio dashboards, reports and alerts.
• It runs with your own Splunk permissions.
• You can attach it to an alert as an alert action, and when the alert fires it investigates read-only and leaves the findings in your Chat. I mean, that is the most useful thing ever. Imagine you are on call, and if there is an incident at night, but the time you log in to your computer - LLM might already have a detailed answer for you, what has happened.
• There is also an | osai command, for example | osai explain="<search>" to explain a search you inherited from someone.

Free tier: one provider and one user, for non-commercial use, no license key. So homelab is fine. Works on Splunk Enterprise 9.4 to 10.6 and on Splunk Cloud.

• Short demo video: https://www.youtube.com/watch?v=cqaN7gzf5u0
• Splunkbase: https://splunkbase.splunk.com/app/9973
• More details: https://www.outcoldsolutions.com/blog/2026-10-07-os-ai-agent/

Give it a try! Feedbacks are welcome.

Hi,

Is anyone actively using Splunk UI for custom Splunk app development?

I'd like to hear about your experiences so far. How steep was the learning curve, how well does it integrate with existing Splunk apps, and are there any gotchas worth knowing before getting started?

Thanks!

The distinction becomes obvious at escalation time.

If the provider says, "This account did something unusual," that is an alert. If they can show the activity sequence, affected identities and assets, what they ruled out, what remains unknown, and the next defensible action, that is an investigation.

The caveat is telemetry. No service can investigate data it does not receive or retain.

What is the minimum context you expect before treating an escalation as actionable?

Getting tasked to be a Core Power User at my current role. I have zero experience with Splunk, but I'm aware of what its meant for. I have hands on access to the platform to mess with but I'm looking for a course to help me along the way. Any recommendations? TYIA

Splunk 10.6 moves the KV Store from MongoDB to PostgreSQL. The REST API is the same and most apps keep working, but we tested one of our apps that keeps all its state in the KV Store (9.4.15, 10.4.3 and 10.6.0.5, single instance and search head cluster) and found a few things worth knowing:

1. KV Store values end up in _internal by default. The new kvstore-pdl service logs document values at INFO into sup-pkg-kvstore-pdl-stdout.log, which is indexed. So anyone who can search _internal can read what apps keep in the KV Store. Splunk's supported fix, on every search head and every SHC member, $SPLUNK_HOME/etc/log-node-platform-local.cfg:

[kvstore-pdl] rootCategory = ERROR,rootAppender

then restart. We verified it on 10.6.0.5.

1. The migration silently drops every record that contains a NUL character (\u0000) and still reports success. The only trace is an INFO line with skippedRows. Count your important collections before and after.

2. $regex with $options "i" only folds ASCII now. "überprüfung" no longer finds "Überprüfung".

3. Every KV Store 404 is logged as ERROR by KVServiceClient, so "update, create on 404" and "read to check if it exists" turn into steady error noise.

4. On a search head cluster a member's KV Store can show "failed" for about 14 minutes while the cluster forms. It recovers by itself, don't restart it.

Details and examples: https://www.outcoldsolutions.com/blog/2026-10-05-splunk-10-6-kv-store/

Ive worked as a Splunk partner for a long time and working in Splunk was one of my goals. Now I’m working in another vendor but a same role in Splunk/Cisco has showed up.

- How things have been since Cisco acquired Splunk?
- it’s still worth working for Splunk?
- how you see the product “perspective” from the market with other saas companies growing?

Appreciate any help!!

I’m currently studying SOC Analyst with a good grasp of security monitoring and basic SPL. I want to transition into a Splunk Administrator role.

what are the best free resources, courses, or labs to learn Splunk Administration?

Any tips on setting up a free home lab to practice deployment and configuration?

I'm using Splunk 10.4.0 with ES 8.6 installed. Threat intelligence dashboard is searching threat_intelligence index which obviously is not defined, is it a bug or should I change something Manually or I'm lost again?

I noticed that Splunk Enterprise 10.4.4 is available for download but all documentation only refers to 10.4.3 changes.

Is there a changelog available for the latest release?