Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re excited to feature a suite of articles that your Splunk Admin will love - how to get maximum performance from the Splunk platform on the indexing, forwarding, and search head tiers. We’re also sharing how you can use SPL2 templates to reduce log size for popular data sources, with guidance on how to implement these safely in production environments. And as usual, we’re sharing all of the other new articles we’ve added over the past month, with articles covering Cisco capabilities, platform upgrades, and more. Read on to find all the details.   Supercharging the Splunk Platform Splunk Lantern is proud to host articles from SplunkTrust members - highly skilled and knowledgeable Splunk users who are trusted advisors to Splunk. This month, we’re bringing you articles from SplunkTrust member Gareth Anderson, who’s sharing a myriad of ways you can optimize performance on the Splunk platform’s forwarding, indexing, and search head tiers. Performance tuning the forwarding tier shows you how to fine-tune your Splunk forwarders to ensure data is ingested efficiently and reliably. This article provides step-by-step guidance on configuring forwarders for optimal performance, including tips on load balancing and managing network bandwidth to help you minimize data delays and maximize throughput. Performance tuning the indexing tier focuses on how you can optimize your Splunk indexers to handle large volumes of data with ease. This article covers key topics such as indexer clustering, storage configuration, and resource allocation, helping you to ensure your indexing tier is always ready to meet your organization’s demands. Finally, Performance tuning the search head tier explains how to enhance the speed of Splunk platform searches. Learn how to manage knowledge objects and lookups, access a range of helpful resources to train your users on search optimization, and find many more tips to help you supercharge Splunk searches. Have you got a tip for optimizing the performance of the platform that’s not included here? Drop it in the comments below!   SPL2 Templates: Smaller Logs, Smarter Searches Many organizations face challenges in managing continuous streams of log data into the Splunk platform, resulting in storage constraints, slower processing, and difficulty in identifying relevant information amidst the noise. Edge Processor and Ingest Processor both help to reduce these log volumes, and now, Splunk is releasing a number of SPL2 templates for popular data sources to help you reduce log volume even further while preserving compatibility with key add-ons, plus the Splunk Common Information Model (CIM). Following best practices for using SPL2 templates provides a process for testing and validating an SPL2 template before using it in a production environment, helping ensure that you’re implementing it safely. Reducing Palo Alto Networks log volume with the SPL2 template explains how you can use SPL2 to optimize log management for Palo Alto Networks data, providing flexibility to let you decide what fields to keep or remove, route the data to specific indexes, and ensure compatibility with Splunk Add-on for Palo Alto Networks, Palo Alto Networks Add-on for Splunk, and the CIM. Finally, Reducing log volume with SPL2 Linux/Unix templates provides you with a pipeline template designed to reduce the size of logs coming from the Splunk Add-on for Unix and Linux, all while preserving CIM compatibility. We’ll keep sharing more SPL2 template articles as they become available. If you want to keep up to date with the latest, subscribe to our blogs to get notified!   Everything Else That’s New Here’s everything else that we’ve published over the month of April: Preparing to upgrade from 9.x to the upcoming release of Splunk Enterprise and Cloud Platform Monitoring Cisco network devices using gRPC Nonprofit use cases Using the Universal Configuration Console Changing chart colors in Dashboard Studio with Matplotlib colormaps Constructing an API test JSON payload for alerting on external dependencies Disabling a user account with Azure AD Graph connector Thanks for reading. Drop us a comment below if you have any questions, comments, or feedback! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re sharing an exclusive look at some of the latest learning that Splunkers are sharing with each other by making insights from our internal Lunch ’n Learn sessions available to you. As well as this, we’re sharing some more use cases that show how you can integrate generative AI with Splunk to supercharge insights and value from popular GenAI tools. And if that’s not enough, we’re also sharing a pile of new use cases that have gone live over the past month. Read on to find out more.   Learn Splunk Like You Work Here Splunkers are a very smart bunch - that’s why Lantern was created! All of our articles are crowdsourced from Splunkers and partners who want to share their hands-on Splunk knowledge gained from working with customers like you. Here at Lantern we’re dedicated to finding as many ways possible for you to benefit from the knowledge that Splunkers hold, so we’re excited to share new articles with you that have been developed from our internal, peer-to-peer learning program, Lunch ’n Learn. This internal learning series provides growth for both seasoned Splunk professionals and newer employees alike. Splunkers volunteer their time to train their fellow employees on a wide variety of topics from workload management to Enterprise Security correlation searches to freezing and thawing data buckets. From the exciting list of what has already been presented internally, the Lantern team selected the following practical topics from these Splunk experts to start bringing this collaboration to you: Kristina Richmond, a Global Services Architect specializing in Splunk SOAR  Selecting the correct apps to integrate the Splunk platform and SOAR Developing SOAR use cases using workbooks and playbooks Mike Sakahara, a Splunk Professional Services Consultant Managing Splunk Cloud Platform knowledge objects Using the Splunk Cloud Monitoring Console effectively Justin Thurston, a Senior OnDemand Consultant  Selecting the best method for Amazon data ingestion Selecting the best method for Google data ingestion Getting traces into Splunk APM That's a lot of valuable content across a wide number of Splunk knowledge domains, and it's only the beginning. As long as we keep training each other better internally, the Splunk Lantern team will keep bringing the content out externally to you, our customers.  On Splunk Lantern, you can find lots of additional articles from this project and from other talented Splunkers who work directly with our customers every day, helping them achieve use cases and create unique solutions. Click on the "Splunk Customer Success" tag at the bottom of any article to be taken to a curated search results list. You can further refine the results by product, add-on, and more. We hope you find this content valuable and check back often for more. And remember, you can send the team feedback at any time by logging onto Lantern using your Splunk account and scrolling to the feedback box at the bottom of any article. We look forward to hearing from you and helping you!   AI-Driven Insights It’s probably no surprise to you that articles that concern generative AI applications are some of Lantern’s most-read pages. We’re happy to share that we’ve published two more articles this month that help you learn more ways to use Splunk to monitor GenAI apps and supercharge your SPL. Monitoring Gen AI apps with NVIDIA GPUs shows you how to gain insights into AI application performance, resource utilization, and errors by integrating NVIDIA's GPUs with Splunk Observability Cloud. The unified workflow shown in this article enables teams to standardize observability practices, streamline troubleshooting, and optimize AI workload performance, leading to faster and more reliable AI-driven innovation.   Implementing key use cases for the Splunk AI Assistant for SPL shows you how to improve your existing search and analysis workflows with the Splunk AI Assistant for SPL. This Splunkbase app leverages generative AI to help you adopt Splunk more quickly and effectively. It includes step-by-step guidance on adopting the following use cases: Discover the data in the Splunk platform  Learn how to parse and enrich data  Perform cyber security investigations and analysis  Perform observability and ITOps investigations and analyses  Gain administrative insights  Learn and master Splunk commands We’ll keep sharing more of these popular AI articles as they become available. If you want to keep up to date with the latest, subscribe to our blogs to get notified!   Everything Else That’s New It’s been a bumper month for new content on Lantern, with articles covering a huge range of use cases and tips to help you get more out of Splunk. Here’s everything that’s new this month: Splunk Platform Using Splunk as a data store for developers Managing Splunk Cloud Platform knowledge objects Setting up Azure Event Hubs in Data Manager Bypassing a database for faster processing Preventing premature bucket rolling in metrics indexes Security Conducting a SIEM use case development workshop Integrating Cisco Secure Network Analytics (SNA) with Enterprise Security and RBA Conducting an insider threat workshop in your organization Observability Integrating Google Kubernetes Engine with Splunk Observability Cloud Managing observability configurations as code with the Splunk Observability Cloud Terraform provider Monitoring Amazon Elastic Kubernetes Services (EKS) with Splunk Observability Cloud Monitoring MariaDB and MySQL with Observability Cloud Monitoring Postgres with OpenTelemetry Integrating Google Kubernetes Engine with Splunk Observability Cloud Enabling persistent queue for metrics and traces Selecting the correct apps to integrate the Splunk platform and SOAR Developing SOAR use cases using workbooks and playbooks Getting traces into Splunk APM Monitoring third-party API calls using the OpenTelemetry SpanMetrics Connector Detect and Prioritize App Security Vulnerabilities Thanks for reading. Drop us a comment below if you have any questions, comments, or feedback! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month sees Lantern wrap up another financial year, so it’s a great time to take a look back at the articles that resonated most with our community over the past year, as well as over all time. With more than 350,000 new users finding our articles over the past year, it’s been a great year for learning with Lantern. More users are finding value in our articles than ever before, and we’re excited to share the top-performing content that helped you achieve more with Splunk! As ever, we’re also sharing the new articles we published over the past month. Read on to find out more.   Lantern’s Top Content While Lantern covers a wide range of Splunk use cases and best practices, some articles stood out as clear favorites among our users. Here’s the most-read content across Security, the Platform, and Observability - from foundational guidance to advanced techniques.   Security: Most Viewed Use Cases and Product Tips Security professionals rely on Splunk’s premium security products to enhance their threat detection, risk management, and security analytics capabilities. Here are the security articles on Lantern that gained the most views last year: Most Popular Security Use Cases (2024) Automating the investigation of emails for malicious content Identifying and removing malicious emails with Splunk SOAR from within Microsoft 365 mailboxes De-identifying PII consistently with hashing in Edge Processor Most Popular Security Use Cases (All Time) Implementing risk-based alerting in Splunk Enterprise Security Using threat intelligence in Splunk Enterprise Security Assessing and expanding MITRE ATT&CK coverage in Splunk Enterprise Security Most Popular Security Product Tips (2024) Installing and upgrading to Splunk Enterprise Security 8x​ Enabling Windows event log process command line logging via group policy object​ Configuring Windows event logs for Enterprise Security use​ Most Popular Security Product Tips (All Time) Managing data models in Splunk Enterprise Security​ Using the Splunk Enterprise Security assets and identities framework Installing and upgrading to Splunk Enterprise Security 8x​   Platform: Most Viewed Use Cases and Product Tips Splunk users across all industries turn to Lantern for expert advice on searching or optimizing their Splunk Enterprise or Splunk Cloud Platform deployments. Here are the top-read platform articles: Most Popular Platform Use Cases (2024) Monitoring Cisco switches, routers, WLAN controllers and access points Using Cross-Region Disaster Recovery for OCC and DORA compliance Solution Accelerator for Operational Technology (OT) Security Most Popular Platform Use Cases (All Time) Detecting a ransomware attack Monitoring for network traffic volume outliers Investigating a ransomware attack Most Popular Platform Product Tips (2024) Sizing your Splunk architecture​ Understanding how to use the Splunk Operator for Kubernetes​ Optimizing Splunk knowledge bundles​ Most Popular Platform Product Tips (All Time) Writing better queries in Splunk Search Processing Language Replacing null values by using the fillnull and filldown commands Using ingest actions in Splunk Enterprise   Observability: Most Viewed Use Cases and Product Tips With Splunk’s observability solutions growing in adoption, more users than ever are relying on Lantern for guidance on monitoring, troubleshooting, and optimizing performance with Splunk. Here’s what stood out in observability last year: Most Popular Observability Use Cases (2024) Instrumenting LLM applications with OpenLLMetry and Splunk​ Monitoring LangChain LLM applications with Splunk​ Monitoring VMware components with Infrastructure Monitoring​ Most Popular Observability Use Cases (All Time) Managing the lifecycle of an alert: from detection to remediation​ Monitoring API transactions Instrumenting LLM applications with OpenLLMetry and Splunk​ Most Popular Observability Product Tips (2024) Rigor to Synthetics Migration - Customer FAQ​ Monitoring Adobe Experience Manager as a Cloud Service​ Customizing JMX metric collection with OpenTelemetry​ Most Popular Observability Product Tips  (All Time) Accelerating ITSI event management​ The definitive guide to best practices for ITSI​ Rigor to Synthetics Migration - Customer FAQ​   A Huge Thank You to Our Contributors! None of this would be possible without the incredible Splunkers, partners, and community members who share their knowledge with Lantern. This past year we published more than 200 new articles covering Splunk platform best practices, security insights, and observability enhancements. We also hit an exciting milestone - over 1,000 published articles on Splunk Lantern! Lantern continues to grow as a vital resource for Splunk users. Whether you’re new to Splunk or a seasoned expert, we’re committed to delivering actionable insights to help you succeed. We’ve got lots more articles and enhancements planned over the coming year, so if you haven’t already, hit the subscribe button on Lantern’s Community blogs label to ensure you’re always up-to-date with the latest news.   Everything Else That’s New Here’s a roundup of the new articles we’ve published this month: Detecting financial fraud using the Splunk App for Behavioral Profiling Monitoring mandatory time away (MTA) with the Splunk platform Selecting the best method for GCP data ingestion Selecting the best method for AWS data ingestion Developing add-ons with a Gold Standard methodology Thanks for being part of the Lantern community - here’s to another year of learning, growing, and making the most of Splunk! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re excited to share articles from the experts at Splunk Professional Services that help you conduct a Splunk Platform Health Check, implement OpenTelemetry in Observability Cloud, and integrate Splunk Edge Processor. If you’re looking to improve compliance processes in regulated industries like financial services or manufacturing, we’re also featuring new articles that could help you with this. Additionally, we’re showcasing more new articles that dive into workload management, advanced data analysis techniques, and more. Read on to explore the latest updates.   Unlocking Expert Knowledge from Splunk Professional Services Splunk Professional Services has long provided specialized guidance to help customers maximize their Splunk investments. Now, for the first time, we’re excited to bring some of that expertise directly to you through Splunk Lantern.  These newly published, expert-designed guides provide step-by-step guidance on implementing various Splunk capabilities, ensuring smooth and efficient deployments and a quicker time to value for your organization. Running a Splunk platform health check is a helpful guide to all Splunk platform customers that walks you through best practices for assessing and optimizing your Splunk deployment, helping you to avoid performance bottlenecks and ensure operational resilience. Accelerating an implementation of OpenTelemetry in Splunk Observability Cloud is designed for organizations new to OpenTelemetry. It provides step-by-step instructions on setting up telemetry in both on-premises and cloud infrastructures using the Splunk Distribution of the OpenTelemetry Collector and instrumentation libraries. Key topics include filtering, routing, and transforming telemetry data, as well as application instrumentation and generating custom metrics. Finally, Accelerating an implementation of Splunk Edge Processor guides you through rapidly integrating Splunk Edge Processor into your environment with defined, repeatable outcomes. By following this guide, you'll have a functioning Edge Processor receiving data from your chosen forwarders and outputting to various destinations, allowing for continued development and implementation of use cases. These resources provide a self-service starting point for accelerating Splunk implementations, but for organizations looking for tailored guidance, Splunk Professional Services is here to help. Contact Splunk Professional Services to learn how expert-led engagements can help you.   Splunk for Regulated Industries Compliance and security are top priorities for many organizations. This month, we’re featuring two industry-focused articles that explore the abilities of the Splunk platform in helping you to ensure regulatory compliance: Using Cross-Region Disaster Recovery for OCC and DORA compliance discusses implementing cross-region disaster recovery strategies to ensure business continuity and meet regulatory requirements set by the Office of the Comptroller of the Currency (OCC) and the Digital Operational Resilience Act (DORA). It provides insights into setting up disaster recovery processes that align with these regulations, helping organizations maintain compliance and operational resilience. Getting started with Splunk Essentials for the Financial Services Industry introduces Splunk Essentials - a resource designed to help enhance security, monitor transactions, and meet compliance requirements specific to the financial services industry. It offers practical advice on leveraging the Splunk platform's capabilities to address common challenges in this sector.   Everything Else That’s New Here’s a roundup of the other new articles we’ve published this month: Adopting Workload Management with cgroups v2 Using the DensityFunction algorithm in Machine Learning Toolkit 5.5 Using the rest command to work with data from REST API endpoints We hope you’ve found this update helpful. Thanks for reading! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re spotlighting articles that feature instructional videos from the Splunk How-To YouTube channel, created by the experts at Splunk Education. These videos make it easier than ever to level up your skills, streamline your workflows, and take full advantage of Splunk software capabilities. In addition to these highlighted articles, we’ve published a range of new content covering everything from optimizing end-user experiences to accelerating Kubernetes implementations. Read on to find out more.   Expert Tips from Splunk Education Have you explored the Splunk How-To YouTube channel? This great resource is packed with video tutorials that simplify complex concepts to help you get the most out of Splunk, created and curated by the experts on our Splunk Education team. Here at Lantern, we include these topics in our library so our users don't miss out on these vital tips. This month, we’ve published a batch of new articles that include hands-on guidance for mastering Splunk Enterprise 9.x, leveraging Enterprise Security 8.0 workflows, and more. Each article features an engaging video tutorial and a breakdown of what you can expect to watch. Here’s the full list: Installing Splunk Enterprise 9.x on Windows Follow these step-by-step instructions to deploy Splunk Enterprise 9.x on Windows systems with best practices. Installing Splunk Enterprise 9.x on Linux Follow this guide to deploy Splunk Enterprise 9.x in Linux environments. Using Enterprise Security 8.0 workflows Learn how to streamline investigations and utilize workflows effectively in Enterprise Security 8.0. Using risk-based alerting and detection in Enterprise Security 8.0 Enhance your security posture with risk-based alerting and detection capabilities. Enabling auto-refresh on the Analyst queue in Enterprise Security Discover how to enable auto-refresh for the Analyst Queue to optimize investigation efficiency. Searching investigation artifacts with the Analyst queue in Enterprise Security 8.0 Learn how to effectively search investigation artifacts using the Analyst Queue in Enterprise Security 8.0. Using SPL2 for efficient data querying Explore the powerful features of SPL2 for precise and efficient data querying.   We hope these videos inspire you to take your Splunk practices to the next level. Explore the articles, watch the videos, and let us know in the comments below if there are any topics you’d like to see featured next!   Observability in Action Effective observability is the key to ensuring seamless operations, reducing downtime, and optimizing performance across IT and business environments. This month, we’ve published several new Lantern articles that explore the latest in observability solutions and strategies to help you unlock actionable insights with Splunk. Accelerating an implementation of Kubernetes in Splunk Observability Cloud is a complete guide to kickstarting your Kubernetes journey in Splunk Observability Cloud. This guide offers best practices for performing a smooth implementation to monitor your containerized environments.   Accelerating ITSI event management explores how IT Service Intelligence (ITSI) can enhance event management processes with this practical guide, designed to help you identify, respond to, and resolve incidents more quickly. If you’re an AEM user, don’t miss Monitoring Adobe Experience Manager as a Cloud Service which explains how you can optimize end-user experiences with proactive response strategies. Finally, Using observability-related content in Splunk Cloud Platform shares how you can utilize observability-related content in Splunk Cloud Platform to maximize visibility and performance in cloud environments. These articles demonstrate the power of Splunk’s observability solutions in streamlining your operations and driving the business outcomes that matter most to you. Click through to read them, and let us know what you think!   Everything Else That’s New Here’s everything else we’ve published over the month: Using Edge Processor to mask or truncate cardholder data for PCI DSS compliance Using Edge Processor to filter out cardholder data for PCI DSS compliance Using the Splunk App for PCI Compliance Nagios Adobe We hope you’ve found this update helpful. Thanks for reading! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re focusing on our exciting new articles related to the Solution Accelerator for OT Security and Solution Accelerator for Supply Chain Optimization, which are both designed to enhance visibility, protect critical systems, and optimize operations for manufacturing customers. In addition, for Amazon users, we’re exploring the wealth of use cases featured on our Amazon data descriptor page, as well as sharing our new guide on sending masked PII data to federated search for Amazon S3 - a must-read for managing sensitive data securely. Plus, we’re sharing all of the other new articles we’ve published over the past month. Read on to find out more.   Enhancing OT Security and Optimizing Supply Chains Operational Technology (OT) environments pose unique security challenges that require tailored solutions. Traditional IT security strategies often fall short when applied to OT systems due to these systems' reliance on legacy infrastructure, critical safety requirements, and the necessity for high availability. To address these challenges, Splunk has introduced the Solution Accelerator for OT Security, a free resource designed to enhance visibility, strengthen perimeter defenses, and mitigate risks specific to OT environments. Our Lantern article on this new Solution Accelerator provides you with everything you need to know to get started with this helpful tool. Key capabilities include: Perimeter monitoring: Validate ingress and egress traffic against expectations, ensuring firewall rules and access controls are effective. Remote access monitoring: Gain insights into who is accessing critical systems, from where, and when, so you can safeguard against unauthorized access. Industrial protocol analysis: Detect unusual activity by monitoring specific protocol traffic like Modbus, providing early warnings of potential threats. External media device tracking: Identify and manage risks from USB devices or other external media that could bypass perimeter defenses. With out-of-the-box dashboards, analysis queries, and a dedicated Splunk app, this accelerator empowers organizations to protect their critical OT systems effectively.   For businesses navigating the complexities of supply chain management, real-time visibility is crucial to maintaining efficiency and meeting customer expectations. The Lantern article on the Solution Accelerator for Supply Chain Optimization shows how organizations can use this tool to overcome blind spots and optimize every stage of the supply chain. This accelerator offers: End-to-end visibility: Unified insights from procurement to delivery, ensuring no process is overlooked. Inventory optimization: Real-time and historical data analyses to fine-tune inventory levels and forecast demand with precision. Fulfillment and logistics monitoring: Tools to track order processing and delivery performance, minimizing delays and costs. Supplier risk management: Assess supplier performance and identify potential risks to maintain a resilient supply network. Featuring prebuilt dashboards, data models, and guided use cases for key processes like purchase order monitoring and EDI transmission tracking, this accelerator simplifies the adoption of advanced analytics in supply chain operations. Both accelerators are freely available on GitHub and offer robust frameworks and tools to address the unique challenges of OT security and supply chain optimization. Explore these resources to drive better outcomes in your operations today.   Working with Amazon Data Do you use Amazon Data in your Splunk environment? If so, don’t miss our Amazon data descriptor page! Packed with advice and one of the most often accessed sections in our site library, it covers everything from monitoring AWS environments to detecting privilege escalation and managing S3 data. This month, we’ve published a new article tailored for S3 users: Sending masked PII data to the Splunk platform and routing unmasked data to federated search for Amazon S3 (FS-S3). It guides you on how to: Mask sensitive data like credit card numbers for Splunk Cloud ingestion. Store unmasked raw data in S3 for compliance and use federated search for cost-effective access.   Explore this article and more on our Amazon data descriptor page to enhance your AWS and Splunk integration!   Everything Else That’s New Here’s everything else we’ve published over the month: Monitoring and logging MQTT topic messages using Eclipse Mosquitto Configuring and monitoring NETSCOUT Omnis AI Streamer data Netscout Classic dashboard export deprecation FAQ Monitoring electronic data interchange transmission and acknowledgement Monitoring purchase order lifecycles We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re excited to share some big updates to the Financial Services section of our Use Case Explorer for the Splunk Platform. We’re also sharing the rest of the new articles we’ve published this month, featuring some new updates to our Definitive Guide to Best Practices for IT Service Intelligence (ITSI) and many more new articles that you can find towards the end of this article. Read on to find out more.   Finessing Splunk for Financial Services The Lantern team has been busy working with Splunk’s industry experts to update our Use Case Explorer for the Splunk Platform with brand-new use cases. The Use Case Explorer is a great tool to help you implement new use cases using either Splunk Enterprise or Splunk Cloud Platform, containing use cases that have been developed for seven key industries - Financial Services, Healthcare, Retail, Technology Communications and Media, Public Sector, Manufacturing, and Energy. This month, we’ve launched a new Deployment Guide for Detecting and preventing fraud with the Splunk App for Fraud Analytics. This new guide introduces you to ways you can use the Spunk App for Fraud Analytics to enable detections for account takeovers, wire transfer fraud, credit card fraud, and new account fraud. We’ve also published a number of new use cases that give you even more options for ways you can use the Splunk platform and Splunk apps to detect fraud within financial services settings. The following articles show you how you can set up basic detections in the platform to detect account abuse, account takeovers, or money laundering. Alternatively, you can choose to use the Splunk App for Behavioral Analytics to create advanced techniques leveraging user behavioral analytics, helping you to stay ahead of these emerging threats. Monitoring for account abuse with the Splunk platform Monitoring for account takeover with the Splunk platform Monitoring money laundering activities with the Splunk platform Monitoring for account abuse with the Splunk App for Behavioral Analytics Monitoring for account takeover with the Splunk App for Behavioral Analytics Monitoring money laundering activities with the Splunk App for Behavioral Analytics   ITSI Best Practices We’re constantly adding to and updating the Definitive Guide to Best Practices for IT Service Intelligence, and this month we’ve added even more new articles for ITSI users to explore. Using the Content Pack for ITSI Monitoring and Alerting for policy management shows you how to use correlation searches and notable event aggregation policies that will save you time and administrative effort. Understanding the less exposed elements of ITSI provides helpful information on the macros and lookups that ship with ITSI, which can provide you quick access to valuable information about your environment. Understanding anomaly detection in ITSI teaches you how to best use detection algorithms in ITSI in order to deploy them effectively to the right use cases.  These new articles are just some of many articles in the Definitive Guide to Best Practices for IT Service Intelligence, so if you’re looking to improve how you work with ITSI then don’t miss this helpful resource!   Everything Else That’s New Here’s everything else we’ve published over the month: Using the MITRE map in Mission Control Installing and upgrading to Splunk Enterprise Security 8x Using federated search for Amazon S3 (FS-S3) to filter, enrich, and retrieve data from Amazon S3 Finding, deploying, and managing security detections Demonstrating ROI from SOAR Ingesting VPC flow logs into Edge Processor via Amazon Data Firehose We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re excited to share some articles that show you new ways to get Cisco and AppDynamics integrated with Splunk. We’ve also updated our  Definitive Guide to Best Practices for IT Service Intelligence (ITSI), and as usual, we’re sharing all the rest of the use case, product tip, and data articles that we’ve published over the past month. Read on to find out more. Splunking with Cisco and AppDynamics Here on the Splunk Lantern team we’ve been busy working with experts in Cisco, AppDynamics, and Spunk to develop articles that show how our products can work together. Here are some of the most recent articles we’ve published, and keep watching out for more Cisco and AppD articles over the coming months! Monitoring Cisco switches, routers, WLAN controllers and access points shows you how to create a comprehensive solution to monitor Cisco network devices in the Splunk platform or in Splunk Enterprise Security. Learn how to get set up, create visualizations, and troubleshoot common problems in this new use case article. Enabling Log Observer Connect for AppDynamics teaches you how to configure Log Observer Connect for AppDynamics, allowing you to access the right logs in Splunk Log Observer Connect with a single click, all while providing troubleshooting context from AppDynamics. Looking for more Cisco and AppDynamics use cases? Check out our Cisco and AppDynamics data descriptor pages for more configuration information, use cases and product tips, and please let us know in the comments what other articles you’d like to see! ITSI Best Practices The Definitive Guide to Best Practices for IT Service Intelligence is a must-read resource for ITSI administrators, with essential guidelines that help you to unlock the full potential of ITSI. We’ve just updated this resource with fresh articles to help you ensure optimal operations and exceptional end-user experiences. Using dynamic entity rule configurations is helpful for anyone who often adds or removes entities from their configurations. Learn how to create a rule configuration that updates immediately and without the need for service configuration changes, reducing the time and risk of error that can result from manually reconfiguring entity filter rules. If you use the ITSI default aggregation policy, you might not know that you shouldn’t be using this as your primary aggregation policy. Learn why and how to build policies that better fit your needs in Utilizing policies other than the default policy. Building your own custom threshold templates shows you how to use and customize the 33 ITSI out-of-the-box thresholding templates with the ability to configure time policies, choose different thresholding algorithms, and adjust sensitivity configurations. Finally, Knowing proper adaptive threshold configurations explains how to best use adaptive thresholding in the most effective way possible, helping you to avoid confusing or noisy configurations.   These four new articles are just some of many articles in the Definitive Guide to Best Practices for IT Service Intelligence, so if you’re looking to improve how you work with ITSI then don’t miss this helpful resource. The Rest of This Month’s New Articles Here’s everything else we’ve published over the month: Maximizing performance with the latest Splunk platform capabilities Monitoring LangChain LLM applications with Splunk Introduction to the Splunk ACS Github Action CI/CD Starter Integrating Kubernetes and Splunk Observability Cloud Expanding AWS log ingestion capabilities with custom logs in Splunk Data Manager Using Ingest Processor to convert JSON logs into metrics Using generative AI to write and explain SPL searches We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month, we’re sharing all the details on an interesting new article on how to instrument LLMs with Splunk, a bunch of new Kubernetes articles, and a new Getting Started Guide for Splunk Asset and Risk Intelligence. We’ve also published lots of brand new use case, product tip, and data articles that we’ll share at the end of this blog. Read on to find out more.   Boost LLM observability with Splunk Many organizations have started to integrate LLM platforms like ChatGPT into their workflows, leveraging generative AI capabilities to improve productivity for their employees and customers.   But how can LLM applications be made observable? In our new article Instrumenting LLM applications with OpenLLMetry and Splunk you’ll find a step-by-step guide that demonstrates how OpenTelemetry can be used to view LLM data in Splunk Observability Cloud. If you like this article, you might also be interested to see another ChatGPT article we published recently, Monitoring applications using OpenAI API and GPT models with OpenTelemetry and Splunk APM.   Mastering Kubernetes and Splunk Some of the most popular articles on Splunk Lantern cover how best to integrate Kubernetes with the Splunk platform, so we’re happy to share a number of new articles on this topic that we’ve published throughout August.  Detecting and resolving issues in a Kubernetes environment shows you how to ​​implement a scalable observability solution that provides an overview of Kubernetes architecture, highlighting real-time issues and allowing you to act fast and mitigate impact. Enabling access between Kubernetes indexer clusters and external search heads teaches you how to use the Splunk Operator for Kubernetes to ensure continued communication between Splunk indexer clusters running on Kubernetes and search heads that are external to the Kubernetes environment. Improving hardware utilization by moving indexers into Kubernetes explains how Kubernetes and the Splunk Operator for Kubernetes can improve utilization of hardware by running multiple indexers (or K8s pods) on each bare metal server. Using Kubernetes Horizontal Pod Autoscaling demonstrates how you can use autoscaling to increase the capacity of your Kubernetes environment to match application resource demands with minimal manual intervention. Finally, Understanding how to use the Splunk Operator for Kubernetes introduces you to how you can use the Splunk Operator for Kubernetes to simplify getting Splunk indexer clusters, search head clusters, and standalone instances running within Kubernetes. What other Kubernetes-related articles would you like to see us tackle next? Let us know in the comments below!   Getting Started with Splunk Asset and Risk Intelligence If you struggle with asset discovery, risk management, or maintaining compliance, our new Getting Started Guide on Splunk Asset and Risk Intelligence (ARI) can help you learn how to use this powerful new product to streamline these processes with ease.  Splunk ARI provides a comprehensive, continuously updated asset inventory by leveraging rich data from the Splunk platform to accurately discover and monitor all assets and identities - including endpoints, servers, users, cloud resources, and OT/IoT devices. It enhances your investigative processes by reducing the time spent pivoting between systems, offering accurate asset and identity context that speeds up investigations and identifies compliance gaps to reduce risk exposure. Like all of our Security Getting Started Guides, this new guide is split into easy-to-navigate steps that walk you through how to prepare for, install, and use ARI. Check out the guide today, and please let us know your feedback in the comments!   This Month’s New Articles Here’s everything else we’ve published over the month: Using file system destinations with file system as a buffer Improving Splunk platform searches with the foreach command Using scheduled export in Dashboard Studio Benchmarking filesystem performance on Linux-based indexers Deleting data from an index Managing time ranges in your searches Monitoring security events with Enterprise Security and Microsoft Copilot for Security Improving Splunk platform searches with bitwise operators ​​Using Federated Search for Amazon S3 (FS-S3) with Edge Processor Configuring file system destinations with ingest actions Installing an existing certificate on a new Splunk Enterprise installation Renewing a certificate on a new Splunk Enterprise installation Using caution when cascading service health scores upwards Improving Smart Mode usage in ITSI Pushing alerts to the Splunk platform and ITSI We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re sharing some great new articles written by members of the SplunkTrust and Splunk MVP programs. We’re also excited to announce that Lantern now supports customers in more countries with our new instant translation feature. And as usual, we’re sharing all the rest of the new articles we’ve published this month. Read on to find out more.   Expert Insights from SplunkTrust and Splunk MVP Members The SplunkTrust is a group of highly skilled and knowledgeable Splunk users who are trusted advisors to Splunk. Members of the SplunkTrust are selected based on their exceptional technical skills and suggestions which shape the future of Splunk’s products. Splunk MVPs are members of the Splunk community who have been recognized for their contributions to community programs, like Splunk Answers or Splunk User Groups. Similarly to SplunkTrust, these are individuals who support and help the Splunk community as a whole with their helpfulness and knowledge.  We’re very proud to have started working with these groups to produce new Lantern articles that add to the quality and richness of information available on our site! Here are a few highlights from the first batch to go live. We all know that Splunk can be used to monitor almost anything, but have you ever wondered how you might use Splunk to monitor unusual things, like plants or even animals? Our new article, Using the Splunk platform to monitor key horse-related data points, is a fun and interesting read not only for horse owners, but also for anyone who might be wondering how to monitor non-standard things with Splunk. If you’ve ever struggled with getting data into the Splunk Platform, Avoiding common pitfalls for getting data in is a helpful article that lays out some of the common pitfalls to avoid. It includes guidance on correctly configuring HTTP Event Collector (HEC) unit timestamps, sharing configurations system-wide, and how to set up index-time versus search-time field extractions so you don’t end up with duplicate values in your search results. Do you know the difference between the inputlookup and lookupcommands used in searches? If you use Splunk Answers for information on the commands, you might find that some of your peers confuse them, but they are not interchangeable. Using inputlookup and lookup commands correctly lays out the use cases for each with some examples of how you might use these commands in your searches. Finally, Using contentctl to speed up your SOC shows you how you can use contentctl, otherwise known as the Content Control Tool, to get detections into Splunk Enterprise Security. Using contentctl with a detection-as-code approach provides a range of benefits that help you to operate your SOC more efficiently and consistently.   Instant Translation on Lantern We’re very happy to announce that Splunk Lantern articles are now available in Japanese, Spanish, and Portuguese! To access these language options, click the person icon in the upper-right corner and log in using your Splunk account information. After logging in, you will see a drop-down in the upper-left that allows you to switch any article (and many of the page elements) to the language of your choice. As you navigate through the site, the content will remain in your chosen language until you select a new one.  At this time, screenshots, videos, and PDF downloads are still only available in English. Additionally, site content is only searchable in English. For a full list of limitations, click here. We hope to offer a more complete translated experience in the future. As with all Lantern articles, these translations rely on feedback from users like you to improve it. On each article, you'll find a small tab on the right side where you can share your opinion on the quality of translation. If you’re a Japanese, Spanish or Portuguese speaker, please give this new feature a try and let us know your thoughts!   This Month’s New Articles Here are all of the other articles we’ve published throughout July: Using service sandboxes in Splunk ITSI Supporting a cloud forensics workflow Monitoring common Operational Technology protocol ports Using ingest actions to filter Palo Alto Logs Configuring Splunk add-on for McAfee/Skyhigh Web Gateway Skyhigh Security Monitoring DNS queries and responses Using an Edge Processor to save Splunk Virtual Compute Monitoring removable media devices in Operational Technology environments Identifying indicators of fraud using geometric principles Monitoring remote access to Operational Technology environments We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re focusing on a series of new Edge Processor articles designed to help you quickly grow your Edge Processor footprint. We’re also featuring three Operational Technology use cases for customers in the energy and manufacturing sectors, as well as sharing details on all of the other new use cases we’ve published over the past month. Read on to find out more.   Scaling Edge Processor Infrastructure Lantern is growing its library of Edge Processor articles with a series of product tips that show you how to scale Edge Processor using Amazon EKS, helping you to alleviate scaling challenges and provide a fast on-ramp for growing your Edge Processor footprint in a rapid and easily supported way.  This series introduces you to a process for scaling with a number of articles that should be read in order. To start, Scaling Edge Processor infrastructure introduces you to different scaling scenarios, exploring the pros and cons of scaling up versus scaling out so you can decide the approach that’s right for your organization. Establishing authentication requirements for node scaling automation helps you to understand and prepare for on-demand authentication so you’re well-prepared to build dynamic scaling for Edge Processor. Running Edge Processor in containers shows you how to run Edge Processor in containers, a best-practice method that helps alleviate a lot of the technical and administrative work found in typical infrastructure scale-out. After you have Edge Processor nodes running from containers, you can move on to deploying, scaling, and managing those containers with Kubernetes. Running Edge Processor nodes in Amazon EKS lays out step-by-steps you can follow to do this. Finally, Load balancing traffic to Edge Processors in Amazon EKS shows you how to create a path from data sources into Edge Processor nodes that are running in containers, finishing up the whole process. The context and detailed explanations in this series of articles should help you develop a dynamically scaled Edge Processor infrastructure ready to meet your data routing needs. Click here to see all of our Edge Processor articles, and let us know in the comments below what other Edge Processor articles you’d like to see on Lantern!   Optimizing Operational Technology Many energy and manufacturing customers utilize Operational Technology (OT) systems to control processes, devices, and infrastructure, so we’re excited to publish a set of new articles to Lantern’s Use Case Explorer for the Splunk Platform that focus on this area. Monitoring ingress and egress traffic across Operational Technology perimeters shows you how to identify threats and gain insights into the traffic that flows across OT perimeters, or airgaps, with six different searches you can use to identify traffic moving in different ways. Many organizations use remote desktop connections to allow support staff and vendors access into OT environments, but these connections can open up organizations to threats which could shut down critical operations. Monitoring remote access to Operational Technology environments shows you how you can prevent this by utilizing search and building dashboards that help you to monitor access through remote access hosts. Finally, Monitoring removable media devices in Operational Technology environments shows you how to prevent security breaches caused by connected removable media devices such as USB devices. It contains a number of searches for you to use to identify removable media usage, as well as allowlisting any devices that have been approved by your organization.  We hope that these new use cases provide value, ideas and inspiration for all of our energy and manufacturing customers! Drop a comment below if you have any questions or feedback on these articles.   This Month’s New Articles Here are all of the other articles we’ve published throughout June: Monitoring applications using OpenAI API and GPT models with OpenTelemetry and Splunk APM Ingesting AWS S3 data written by ingest actions Applying Zipf's law in fraud detection Deploying Workload Identity Federation between AWS and GCP   What Else? If you’re looking for more ways to access industry-specific guidance, Lantern’s industry-specific articles from the Use Case Explorer for the Splunk Platform are now searchable through the Resources section of splunk.com. We’re always looking for more ways to help you surface helpful content from Lantern, and we hope that this gives you one more way to find use cases that help you get even more value from your Splunk deployment. We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re focusing on some great new articles that have been written by Splunk’s Authorized Learning Partners (ALPs). We’re also looking for your use case ideas to help Lantern expand its use case library, and as usual, we’re sharing the full list of articles published over the past month. Read on to find out more. Conquer New Data Sources with Splunk ALPs We’re excited to share some great new articles that have been brought to us by Splunk’s Authorized Learning Partners. ALPs are organizations that provide Splunk courses and education services, with localized training available around the world. ALP instructors are highly experienced Splunk experts, so we’re thrilled to publish these new ALP-written articles that all Splunk users can benefit from. Here are two new data descriptors and associated use cases that have been written this month by our ALPs.   CyberArk If you’re working with the CyberArk Identity Security Platform or using the CyberArk EPM for your endpoints, our new CyberArk data descriptor page shows you how to ingest data from these data sources. We’ve also published Validating endpoint privilege security with CyberArk EPM, which walks you through all the dashboards you can access for this platform within Splunk by using the CyberArk EPM App.    MOVEit MOVEit is a managed file transfer software product produced by Progress Software. MOVEit encrypts files and uses file transfer protocols such as FTP(S) or SFTP to transfer data, as well as provides automation services, analytics, and failover options.  MOVEit Automation helps you automate tasks like pushing and pulling files to/from any FTP server based on events or schedule, manipulating/transforming file content, or managing files for transfer, storage or deletion. The use case Reporting on MOVEit automation activities shows you how you can access reporting dashboards for your MOVEit Automation instance. MOVEit Transfer provides easy and secure file transfer exchanges that keep your organization secure and compliant. You can use the use case Reporting on MOVEit transfer activities to set up reporting on this MOVEit product.   Calling all ALPs! If you’re an ALP who’s interested in writing for Lantern, we’d love to have you on board! Check out our Information Deck, FAQs and fill in the form to submit a content idea to us.   Help Us Expand Lantern's Use Case Library! Did you know that Lantern’s articles are completely crowdsourced from Splunkers, ALPs and partners? We’re lucky to have such a huge community of Splunk experts who write our articles, but we’re always looking to expand our library with the help of innovative ideas from our readers. What is a Lantern use case? It's a detailed, step-by-step guide on how to use Splunk software for achieving specific business outcomes. Some examples of our current use cases include: ​​Splunk platform Security: Detecting a ransomware attack Splunk platform IT Modernization: Managing Azure cloud infrastructure Splunk SOAR: Detecting unusual GCP service account usage Infrastructure Monitoring: Monitoring Kubernetes pods  Have you ever looked for a specific use case on Lantern and haven’t found it? Or maybe you’re looking to get more value out of a particular data source, and seeking guidance to help you do that. If so, we're inviting you to contribute your ideas for use cases in security, observability, or industry-specific applications. Your input will directly influence the development of future Lantern articles, and your proposed use case could be crafted by a Splunk expert to benefit the entire Splunk community. As a token of our appreciation, we're offering exclusive Lantern merch to the first 50 people who submit an idea and come see us at .Conf! Submit your ideas through our online form or in-person at the kiosk. Don’t miss out - start thinking about your unique use case ideas today! Even if you can’t attend .Conf, we’re eager to hear your suggestions. Help us enhance our library by sharing your ideas now!   This Month’s New Articles Here are all of the other articles that are new on Lantern, published over the month of May: Combining multiple detector conditions into a single detector Combining multiple compound detector conditions into a single detector Recovering from an incident using SOAR We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re focusing on a new feedback initiative. We want to hear from you what you’d like to see on Lantern, and we’ve got swag to give away at .Conf for your ideas! As usual, we’re also sharing the full list of articles published over the past month. Read on to find out more. Share Your Use Case Ideas! Did you know that Lantern holds more than 230 use cases in our Use Case Explorer for Security and Use Case Explorer for Observability and the Use Case Explorer for Splunk Platform? While that’s a lot of use cases, we’re always on the lookout for more! So what exactly is a Lantern use case? Our use cases contain step-by-step guidance for applying Splunk software to a real business outcome to help you to self-serve and get to value faster. They might have wide interest or applicability, or they might serve more niche needs. What all of Lantern’s use cases have in common is that they contain practical guidance that you can pick up and use right away in your environment. Here are some examples of use cases within Lantern: ​​Splunk platform Security: Detecting a ransomware attack Splunk platform IT Modernization: Managing Azure cloud infrastructure Splunk SOAR: Detecting unusual GCP service account usage Infrastructure Monitoring: Monitoring Kubernetes pods  Do you have an idea for a security, observability, or industry-specific use case that you’d love to see on Lantern? Share your ideas with us! All of your ideas will inform our article development strategy for the upcoming year, and your article could be written by a Splunk expert for all Splunk customers to benefit from. To say thank you, we’re giving away some exclusive Lantern swag! Just submit an idea and be one of the first 50 visitors to the Splunk Lantern kiosk in the Success Zone at .Conf this year to claim your prize. You can submit your ideas using the form link above, or complete it at the kiosk, so start thinking about your use case ideas now! Even if you won’t be at .Conf, we’re keen to hear what use cases will help you take your Splunk usage to the next level, so please share your ideas with us today!   Spotlight on Security This past quarter, Splunk Lantern has had the pleasure of working with Professional Services (PS) Regional Security Architect David Goodin, who joined us for a job rotation. As an expert PS team member with lots of experience with working with customers, David has a lot of tips and tricks for getting the most out of Splunk software. Now, we’re happy to share them with you all through his articles! Here’s what David wrote for us this month. Properly securing Splunk indexes shows you how you can use role-based access control (RBAC) to secure your indexes and data models. It goes through some of the pros and cons of using search filters versus index restrictions to secure your Splunk instance, and explains some of the performance considerations you’d expect to see. There’s a lot of demand for articles covering federated search, and David’s article on Securing and monitoring federated search is an authoritative guide on how to ensure that federated search in your environment is properly secured and compliant. Identifying non-defensible networks with Splunk details strategies for maintaining a complete asset and identity network inventory, with tips for finding rogue machines.   Using Splunk SOAR to find gaps in your containment strategy shows you how to use Splunk SOAR to automate the containment process through the use of playbooks. Incident responders and their teams might find this use case especially helpful to strengthen their containment strategies in line with best practices. If you liked these use cases, you might also want to check out the rest of David’s articles: Using Splunk's security suite for incident response management Tracking assets when recovering from an incident Using your lessons learned from incidents to harden your SOC processes Enhancing endpoint monitoring with threat intelligence   This Month’s New Articles Here are all of the other articles that are new on Lantern, published over the month of April: Identifying and removing malicious emails with Splunk SOAR from within Microsoft 365 mailboxes Partitioning data in S3 for the best FS-S3 experience Automating the investigation of emails for malicious content Splunk Custom Visualizations App Sunset FAQ Configuring Splunk DB Connect for use with Google BigQuery Monitoring VMware components with Infrastructure Monitoring We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting a brand new set of content on Lantern. Splunk Outcome Paths show you how to achieve common goals that many Splunk customers are looking for in order to run an efficient, performant Splunk implementation. As usual, we’re also sharing the full list of articles published over the past month. Read on to find out more.   Splunk Outcome Paths   In today’s dynamic business landscape, navigating toward desired outcomes requires a strategic approach. If you’re a newer Splunk customer or looking to expand your Splunk implementation, it might not always be clear how to do this while reducing costs, mitigating risks, improving performance, or increasing efficiencies. Splunk Outcome Paths have been designed to show you all the right ways to do all of these things. Each of these paths has been created and reviewed by Splunk experts who’ve seen the best ways to address specific business and technical challenges that can impact the smooth running of any Splunk implementation. Whatever your business size or type, Splunk Outcome Paths offer a range of strategies tailored to suit your individual needs: If you’re seeking to reduce costs, you can explore strategies such as reducing infrastructure footprint, minimizing search load, and optimizing storage. Mitigating risk involves implementing robust compliance measures, establishing disaster recovery protocols, and safeguarding against revenue impacts.  Improving performance means planning for scalability, enhancing data management, and optimizing systems.  Increasing efficiencies focuses on deploying automation strategies, bolstering data management practices, and assessing readiness for cloud migration.  Choosing a path with strategies tailored to your priorities can help you get more value from Splunk, and grow in clarity and confidence as you learn how to manage your implementation in a tried-and-true manner. We’re keen to hear more about what you think of Splunk Outcome Paths and whether there are any topics you’d like to see included in future. You can add a comment below to send your ideas to our team.   Use Case Explorer Updates   Splunk Lantern’s Use Case Explorer for Security and the Use Case Explorer for Observability have become popular tools with Splunk customers looking for a framework for their Security or Observability journey. But technology changes fast, and today’s organizations are under more pressure than ever from cyber threats, outages, and other challenges that leave little room for error. That’s why on team Lantern we’ve been working hard to realign our Use Case Explorers with Splunk’s latest thinking around how to achieve digital resilience. Our Use Case Explorers follow a prescriptive path for organizations to improve digital resilience across security and observability. Each of the Explorers start with use cases to help you achieve foundational visibility so you can access the information your teams need. With better visibility you can then integrate guided insights that help you respond to what's most important. From there, teams can be more proactive and automate processes, and ultimately focus on unifying workflows that provide sophisticated and fast resolutions for teams and customers.   If you haven’t yet checked out our Use Case Explorer for Security or the Use Case Explorer for Observability, take a look today, and drop us a comment below if there’s anything you’d like to see in a future update!   This Month’s New Articles   Here’s the rest of everything that’s new on Lantern, published over the month of March: Enhancing endpoint monitoring with threat intelligence De-identifying PII consistently with hashing in Edge Processor Using lessons learned from incidents to harden your SOC processes Using ingest actions to filter AWS CloudTrail Logs Using ingest actions to filter AWS VPC Flow Logs Applying Benford's law of distribution to spot fraud Proactive Response: Orchestrate response workflows Tracking assets when recovering from an incident Proactive Response: Automate threat analysis Proactive Response: Automate containment and response actions Optimized Workflows: Automate complete TDIR life cycle Optimized Workflows: Federate access and analytics Configuring Windows event logs for Enterprise Security use Unified Workflows: Align IT and Business with Service Monitoring Guided Insights: Understand the Impact of Changes Unified Workflows: Enable Self-Service Observability Foundational Visibility: Optimize Cloud Monitoring Proactive Response: Prevent Outages Proactive Response: Debug Problems in Microservices Proactive Response: Optimize End-User Experiences Enabling Windows event log process command line logging via group policy object We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

It’s been a big news month for Splunk Lantern. Along with celebrating the publication of our 1000th article, we’ve found out that we are up for not just one, but three awards from two different awards providers! We’re thrilled that this reflects how helpful Lantern has become to so many customers, Splunkers and partners, and also shows the significance of the contributions from the expert authors who share their knowledge on Lantern. We are very proud that our team has been named Finalists in two categories in the 18th annual Stevie Awards for Sales & Customer Service. This year's competition saw more than 2,300 nominations from organizations of all sizes, in virtually every industry, and across 47 nations and territories.  We’re also celebrating having been nominated in the annual CXOne Expert Customer Recognition Awards! Read on to find out more, and please consider voting for us here!   Stevie Awards: Best Use of Thought Leadership in Customer Service   This category recognizes the promotion of thought leadership within customer service that enables customers to benefit from the unique knowledge and learnings of individuals and teams within their organizations. The Splunk Lantern website launched in Q2 of 2020 with 46 articles. Since then, Lantern has become a customer success center used widely by Splunkers, partners, and Splunk’s 15,000+ customers alike. All of Lantern’s 1000+ articles are crowdsourced from experts around Splunk, the majority of whom don’t have documentation in their job descriptions. Splunk partners also share their insights gained from real work with customers in the field. Lantern’s site metrics show that more and more users are hungry for the articles we host - between July 2021 and November 2023, Lantern saw new user metrics rise from 5,878 then to 35,842, an increase of 509%, while returning users increased from 1,707 in July 2021 to 29,580, an increase of 1,632%. If you're not one of our regular readers, why not take a moment now to check out all the great content we offer for Platform, Security, and Observability customers?     Stevie Awards: Award for Innovation in Customer Service - Computer Industries   This category recognizes new ideas and developments within customer service that enable organizations to meet the needs of their customers more effectively, leading to increased satisfaction and loyalty. At Splunk Lantern, we’re committed to providing a free platform that offers immediate value to users. We’ve significantly increased customer engagement, with a surge in unique page views from 21,767 in July 2021 to 81,469 by November 2023, representing a remarkable 274% increase. Ongoing executive support for the Splunk Lantern project shows dedication to the success of all Splunk customers, not just those who can afford expensive professional services.  Check out some of the unique content our site offers, such as Data Descriptors (comprehensive guidance for getting data in and applying data to your key use cases) and the Splunk Success Framework (best practices that you can use to create and maintain a smoothly-running Splunk implementation).     CXOne Expert Customer Recognition Awards: Innovation Award   This award recognizes the customer who has thought outside the box. This customer has developed features and functionality within their CXOne Expert site to further optimize its capabilities, as well as the efficacy of its processes. Splunk Lantern is innovative by nature. Its focus is only on customer success outcomes, and no support documentation is held on the site. We align our offerings with customer success programs to drive sales and renewals, and metrics show that our data-driven content analysis led to a 75% increase in new users and a 91.5% surge in returning users last year. Finally, Splunk Lantern is pioneering several pilot projects with CXOne Expert, with a desire to stay abreast of breakthrough functionality in our platform. You can read more about this nomination on the CXOne Expert Awards site and please consider voting for us here!   The Results    The Stevie Awards recognition underscores Splunk's commitment to excellence, innovation, and superior customer service in an ever-evolving landscape. While these awards do not have a voting component, we’re thrilled that our team will ultimately be Gold, Silver, or Bronze Stevie Award winners, and we’ll find out when the awards are unveiled on April 12th. We’re also very proud to have been recognized for the third year in a row at the CXOne Expert awards. Every vote counts in helping us secure a win, so please vote for us today! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re sharing all the details of a brand new Splunkbase app which helps you discover use cases in Lantern’s Use Case Explorer for the Splunk Platform. We’re also highlighting a batch of new Splunk Edge Processor articles that help new users learn how it works, and help more experienced users get even more value from it. As usual, we’ve also got links to every new article that we published over the month of February.  Use Case Explorer App We’re excited to announce the launch of a brand new app that makes it easier than ever for you to work with the Use Case Explorer for the Splunk Platform - the Use Case Explorer App for Splunk. This app searches your Splunk data sources and recommends use cases you can use right away, using the 350 different procedures you can find within the Use Case Explorer for the Splunk Platform. It’s a great tool for identifying new ways you can get more value out of your Splunk implementation, and it links you to the relevant articles in Lantern so you can get started easily. The Use Case Explorer content is designed to help you achieve your Security and IT Modernization goals - even if you're not using Splunk's premium security and observability products. (If you are using these products, you can check out the guidance for them within the Use Case Explorer for Security and Use Case Explorer for Observability.) The Use Case Explorer also contains a wide range of industry-specific use cases. Check out the app today, and don’t hesitate to let us know how it’s helped you by dropping a comment below! Doing More with Splunk Edge Processor This month the Lantern team has been working with experts from all across Splunk to publish new articles that highlight some of the key capabilities in Splunk Edge Processor. Here’s more info on three that we’ve published this month: Reducing Windows security event log volume with Splunk Edge Processor features a great video from the experts at Splunk Edu that shows you how Splunk Edge Processor can be used to help you better manage security event log volume. Converting logs into metrics with Edge Processor for beginners is a great place to get started if you’re new to how Edge Processor works. It shows you how to build metrics with dimensions so you can remove complexity from data, reduce resource consumption, improve data quality, and ultimately reduce mean time to identify problems. Finally, Enriching data via real-time threat detection with KV Store lookups in Edge Processor shows you how to utilize lookups to cross-reference threat intelligence data, which enhances your ability to detect and respond to cybersecurity threats in a timely and efficient manner. We’re continuing to plan even more Edge Processor articles in the future, so drop a comment below if there are any tips you’d like to see, or use cases you’d like us to cover! This Month’s New Articles Here’s the rest of everything that’s new on Lantern, published over the month of February: Customizing JMX metric collection with OpenTelemetry Enriching data via real-time threat detection with KV Store lookups in Edge Processor Rigor to Synthetics Migration Migrating from Tenable LCE to Splunk Enterprise Security Splunk IT Service Intelligence Owner's Manual Checking for event time indexing Checking for KPI search success Maintaining service entities Maintaining adaptive thresholds Monitoring for KPI search lag Splunk User Behavior Analytics (UBA) Owner's Manual Tuning anomaly rules Checking for sizing adherence Patching for operating system security Cleaning up backup file directories Validating data source integrity Implementing a reingestion pipeline for AWS logs using Kinesis Data Firehose Using Amazon SageMaker to predict risk scores We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re featuring our annual rundown of the Lantern articles that are getting the most views, as well as sharing some interesting site metrics with you from our past financial year. We’ve also published new use cases, product tips, and more! If you want to jump straight to our new articles, scroll to the bottom to find them. Splunk Lantern’s Top Articles Splunk has just ended its financial year, so here on Team Lantern we’ve been looking at our yearly metrics to see how much we’ve grown. And our growth has been amazing! Over the past financial year, Lantern has seen nearly a million unique page views - 975,940, which compared to last year’s 613K, represents a 59% increase. We’ve welcomed 314k new users to Lantern, a 75% increase year-on-year. And we have grown our passionate base of returning users to 310k, a figure that’s nearly doubled from last year’s 161k. We’re deeply proud of how we’ve grown to serve so many of you with articles that help you get more value from your Splunk implementation. While we offer hundreds of articles in dozens of areas of interest, here are the pages that came out on top with the most page views over the past year in each of our categories. We hope that you can be inspired by the same Lantern articles that inspired so many Splunk users over the past year! Security Most popular use cases published in FY24 Assessing and expanding MITRE ATT&CK coverage in Splunk Enterprise Security Protecting Operational Technology (OT) environments Detecting consumer bank account takeovers   Most popular use cases of all time Implementing risk-based alerting in Splunk Enterprise Security Using threat intelligence in Splunk Enterprise Security Assessing and expanding MITRE ATT&CK coverage in Splunk Enterprise Security Most popular product tips published in FY24 Using Threat Intelligence Management Configuring Windows security audit policies for Enterprise Security visibility Sending events from the Splunk platform to SOAR Most popular product tips of all time Using the Splunk Enterprise Security assets and identities framework Onboarding data to Splunk Enterprise Security Configuring Windows security audit policies for Enterprise Security visibility Platform Most popular use cases published in FY24 Detecting malicious activities with Sigma rules Monitoring major Cloud Service Providers (CSPs) Building a data-driven law enforcement strategy Most popular use cases of all time Detecting a ransomware attack Monitoring for network traffic volume outliers Investigating a ransomware attack Most popular product tips published in FY24 Replacing null values by using the fillnull and filldown commands Using ingest actions in Splunk Enterprise Working with multivalue fields Most popular product tips of all time Writing better queries in Splunk Search Processing Language Replacing null values by using the fillnull and filldown commands Using ingest actions in Splunk Enterprise   Observability Most popular use cases published in FY24 Managing the lifecycle of an alert: from detection to remediation Identifying DNS reliability and latency issues Monitoring availability and performance in non-public applications Most popular use cases of all time Managing the lifecycle of an alert: from detection to remediation Monitoring Kubernetes pods Monitoring API transactions Most popular product tips published in FY24 Getting started with the Microsoft Teams Add-on for Splunk Collecting Mac OS log files Getting Docker log data Into Splunk Cloud Platform with OpenTelemetry Most popular product tips of all time Getting started with Microsoft Azure Event Hub Getting started with the Microsoft Teams Add-on for Splunk Installing Splunk Connect For Syslog (SC4S) on a Windows network Huge thanks is due to all of our contributors who share their helpful knowledge through our articles. If you're a Splunker who could write an article for us that might make it into our most popular lists next year, then drop us a comment below! This Month’s New Articles Here’s the complete list of everything that’s new on Lantern, published over the month of January: Splunk 9.1.3 FAQ Using Admin Config Service (ACS) in Splunk Cloud Platform FedRAMP environments Migrating to Mission Control Converting complex data into metrics with Edge Processor Using Dashboard Studio inputs in the canvas Using the events viewer visualization in Dashboard Studio Showing and hiding Dashboard Studio elements based on data availability Converting a Classic dashboard to Dashboard Studio Using the Link to Search and Link to Reports interactions in Dashboard Studio Configuring the trellis layout in Dashboard Studio We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting a new video that shows you all the ways Lantern can help you to achieve success. We’ve also published a new section of our Use Case Explorer for the Splunk Platform with brand new use cases relevant for energy sector customers. And as usual, we’re also sharing the rest of the new articles we’ve published this month. Read on to see what’s new. Lantern: Lighting Your Success with Splunk Did you know that Lantern holds nearly a thousand different articles for users of the core platform, plus premium Security and Observability products? Our articles cover everything from the basics of getting started with Splunk for newer users, to more advanced tips to help you work with Splunk like a pro, all the way through to the guidance provided by the Splunk Success Framework to help you operate Splunk as a program in your organization. Whether you’re a user or an admin, new or experienced, and whatever your goals, we’re confident that Lantern has helpful guidance for you. Watch our new 5-minute video for an overview of all of our different types of articles to get up to date with where to find articles that’ll help take your Splunk usage to the next level. Platform Use Cases for Energy Customers The Use Case Explorer for the Splunk Platform helps you develop new use cases using either Splunk Enterprise or Splunk Cloud Platform. The Explorer gives you an easy way to access use cases that are especially relevant for particular industries, such as Finance, Healthcare, Public Sector and more. We’ve just updated the Use Case Explorer with a new section for Energy sector customers. This section contains a number of use cases with searches that are specific to Operational Technology environments, allowing you to improve the security of these environments and ensure compliance with key legislation.  If you’re an energy customer, be sure to bookmark this page - we’ll be adding to it over the coming weeks with more energy-specific content, including new guidance on using Splunk Edge Hub with energy meters. Let us know what you think and what other use cases you’d like to see by dropping a comment below! Everything Else New This Month Here are all of the new articles that we’ve published this month: Protecting Operational Technology (OT) environments Reducing PAN and Cisco security firewall logs with Splunk Edge Processor Detecting Operational Technology assets communicating with external systems Using the OT Security add-on for Splunk to ensure NERC CIP compliance Sharing data between Splunk IT Service Intelligence and Splunk Enterprise Security Using Splunk DataSense Navigator Safeguarding Workload Management operation during the transition to cgroups v2 We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting our new Getting Started Guide that tells you everything you need to know about using Splunk Edge Processor. As usual, we’re also sharing the rest of the new articles we’ve published this month. Read on to see what’s new. Getting Started with Splunk Edge Processor Lantern provides comprehensive Getting Started Guides for all of Splunk’s products across the platform, plus premium Security and Observability products. Our Getting Started Guides are great for onboarding new users, but even if you’re more experienced they can be a great help to ensure you haven’t missed any essential steps or key resources that can help you use our products smoothly and efficiently. This month, we’ve published Getting Started with Splunk Edge Processor. Edge Processor is designed to help you achieve greater efficiencies in data transformation close to the data source and improved visibility into data in motion. If you’re curious about how Edge Processor can help you, our guide can give you a great intro into what’s needed. Check it out to see how easy it is to get started. Machine Learning Toolkit Articles The Splunk Machine Learning Toolkit (MLTK) provides hundreds of thousands of Splunk customers with SPL commands, custom visualizations, assistants, and examples to explore a variety of machine learning concepts.  This month, we’ve published two new articles to help MLTK users get even more out of this powerful app. Preparing data for use with the Machine Learning Toolkit (MLTK) walks you through how to use basic, intermediate, or advanced patterns with the MLTK to help improve your existing or future workflows. Predicting failed trade settlements is a use case for financial services customers, showing how to use the MLTK to predict trade settlement failures and ensure compliance to the T+1 compliance directive. Looking for more MLTK articles on Lantern? Click through to see all of our articles. Everything Else New This Month Here are the rest of the new articles that we’ve published this month: Splunk 9.1.2 FAQ Enabling an audit trail from Active Directory Reducing Smartstore cache churn with smart Workload Management rules Benchmarking website performance against competitors Using comparative testing to drive app performance Using metrics to create KPIs in Splunk ITSI Predicting failed trade settlements Incorporating performance testing into the software development lifecycle We hope you’ve found this update helpful. Thanks for reading! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting some great new updates to our Getting Started Guide for Enterprise Security (ES) that provide you with easy ways to get going on this powerful platform, as well as new data articles for MS Teams. As usual, we’re also sharing the rest of the new articles we’ve published this month. Read on to see what’s new. Getting Started with Splunk Enterprise Security Lantern hosts Getting Started Guides for all of Splunk’s products across the platform, plus premium Security and Observability products. Our Getting Started Guides are great for onboarding new users, but even if you’re more experienced they can be a great help to ensure you haven’t missed any key steps or resources that can help you take your product usage to the next level. This month, we’ve been busy updating our Getting Started Guide for Enterprise Security. This new guide now features new videos from Splunk experts walking you through how to use Enterprise Security dashboards, new guidance on how to find and adopt use cases, and links to all of the resources you’ll need to be successful with ES. You can use our updated Getting Started Guide as your comprehensive toolkit for mastering Enterprise Security effortlessly. Check it out to see how you can enhance your security posture and stay ahead of challenges with our expert guidance at your fingertips. Microsoft Teams Data Articles We’ve also published some helpful configuration guidance for users of the Microsoft Teams Add-on for Splunk. This add-on collects Teams call record data, and our guide on Getting started with the Microsoft Teams Add-on for Splunk shows you how to retrieve that data. Once you’re set up, you can check out the guides Getting started with Microsoft Teams call record data and Getting started with Microsoft Teams call record data and Azure Functions to learn how call record data is made available, and how best to utilize the data. Everything Else New This Month Here are the rest of the new articles that we’ve published this month: Automating Know Your Customer continuous monitoring requirements Integrating REST endpoints with On-Call Monitoring major Cloud Service Providers (CSPs) Getting started with the Google ChromeOS App for Splunk We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting two sets of articles that illustrate how you can effectively use multiple parts of the Splunk product suite to solve some of your most crucial observability problems. These articles show you the synergies between Splunk products and features, showcasing how they work together to enhance your outcomes beyond each product’s individual parts. We’ve also published a handful of other new articles this month - jump to the bottom to see everything new. Empowering Engineers with Unified Observability Splunk Observability Cloud is a seriously powerful package, giving you the benefits of Splunk APM, Splunk RUM, Splunk Infrastructure Monitoring, Splunk Incident Intelligence, and Splunk Log Observer Connect, all in one interface. Thanks to Lantern’s Use Case Explorer for Observability, you can easily access use cases for all of these separate Splunk products. But sometimes, it might not be too clear how these products fit together. Splunk Lantern’s new article, Empowering engineers with unified observability, shows you how you can use every part of Splunk Observability Cloud to solve key problems in cloud-native environments. We’ve developed four key unified observability use cases that can empower engineers at your organization: Business impact of changes Problems in cloud-native environments Self-service observability Visibility between on-premises and cloud Each of these use cases contains written and video guidance on how you can use the different parts of Splunk Observability Cloud in concert to solve these issues. Dive in today and revolutionize your approach to unified observability! Using OpenTelemetry to Get Log Data into Splunk Cloud Platform Once you’ve got correlated log, trace, and metric data in Splunk Observability Cloud, you can use this to troubleshoot application issues in a very rapid and efficient way. But it can be tricky to work out how best to get log data flowing through to Splunk Observability Cloud in the first place. Our new article, Using OpenTelemetry to get data into Splunk Cloud Platform, lays out an effective process for this. First, you’ll see how to set up the OpenTelemetry Demo application with Docker or Kubernetes, then get that log data into Splunk Cloud Platform. Once you’ve done that, you’ll learn how to use Splunk Log Observer Connect to bring the data into Splunk Observability Cloud. The outcome of this process is you’ll have a very efficient way to troubleshoot your application issues with full log, metric, and trace visibility, and we also show you three different processes you can use to troubleshoot. We’re eager to hear if you have any questions about these articles, or if you’d like to see log collection approaches for environments other than Docker and Kubernetes - drop us a comment below to share your thoughts. This Month’s New Articles We’ve also published a few other articles over the past month that cover other interesting product tips, use cases and more. Here’s the list: Introduction to the Splunk Distributed Deployment Server (SDDS) Configuring Windows security audit policies for Enterprise Security visibility Data descriptor: Docker Configuring Splunk 9.0 for Native Common Access Card (CAC) Authentication Using Session Replay in Splunk RUM We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting some significant changes to our Use Case Explorer for Security and Use Case Explorer for Observability, aligning them with Splunk’s new prescriptive value paths for resilience so the use cases you need to drive resilience in your organization are easier than ever to implement. As usual, we’re also sharing the complete list of articles that Lantern has published over the past month. Read on to find out more.  Your Path to Greater Resilience for Security and Observability You’ve probably heard a lot about digital resilience if you attended .conf23, or if you’ve been keeping up with Splunk’s blog. Splunk offers a prescriptive path for organizations to improve digital resilience across security and observability that starts with foundational visibility to access the information teams need. With better visibility, they can prioritize actions and respond to what's most important. From there, teams can be more proactive and automate processes, and ultimately focus on optimizing digital experiences for teams and customers. But helping your own organization down this path isn’t always easy. You might not know where to start, or how to implement the use cases that will ultimately drive your overall resilience. That's where Splunk Lantern’s newly-revised Use Case Explorers for Security and Observability come in. The Use Case Explorers provide you with a structured framework and actionable guidance you can follow to develop digital resilience, wherever your organization is in its data journey. Supercharging Security The Use Case Explorer for Security shows you how to build foundational visibility in your organization through getting the basics right: gathering data in the right way and using tools like Splunk Security Essentials to build a foundational security monitoring program. From there, you'll find out how tools like Splunk Enterprise Security and Splunk SOAR can help you efficiently deal with cyber threats, as well as build modern alerting systems that help you stay on top of issues. When you've learned all this, you'll be able to see how to use Splunk Mission Control to access all your security information in one place, and spot the trends and insights that will help you build and maintain great customer relationships. Optimizing Observability The foundation of the Use Case Explorer for Observability lies in establishing strong observability basics like analyzing logs, which can be done right away in the Splunk platform. Then, as you progress, learn how to use Splunk IT Service Intelligence to gauge the health of services and extract valuable insights from events. You’ll see how to use tools like Splunk APM, Splunk Infrastructure Monitoring, and Splunk On-Call to monitor and manage your systems, identifying and addressing issues with greater ease. Then, to deliver outstanding digital customer experiences, you’ll see how to use Splunk Synthetic Monitoring and Splunk Real User Monitoring to craft experiences that resonate positively with your customers. How to Begin Ready to start? Click through to the Use Case Explorer for Security or the Use Case Explorer for Observability to start learning more. New Prescriptive Adoption Motions This month we’re happy to announce that we’ve published two new sets of Prescriptive Adoption Motions to accompany our existing Prescriptive Adoption Motions for Security with Splunk. Prescriptive Adoption Motions for Observability with Splunk are written by Splunk’s observability experts to help you confidently implement use cases by leveraging proven practices and tailored strategies. Using them helps ensure that your organization not only realizes the full value of Splunk's observability solutions, but also continues to reap their benefits in the long run. Here’s the complete list of new guides for you to browse: Business Service Insights Event Analytics Infrastructure Monitoring Application Monitoring Digital Experience Monitoring We’ve also published two Prescriptive Adoption Motions for the Splunk platform: Using the Splunk platform for Security use cases, and Using the Splunk platform for Observability use cases. These guides help you learn how you can use the core platform to build foundational security and observability processes, without using any of Splunk’s premium security or observability products. Check them out, and let us know what you think! This Month’s New Articles Here are the rest of Lantern’s newly-published articles now live across Platform, Security, and Observability: Reviewing your ITSI environment Deploying predictive analytics at the right time Adopting ITSI capabilities strategically Splunk 9.1.1 FAQ Accessing search history Using the makeresults command Planning an organizational on-call policy Using On-Call reporting to improve your team performance We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re sharing all the new articles we’ve published over the past month, with lots of interesting new use cases, product tips, and data articles. We’re also asking for your vote in our Customer Choice Content Competition - over the quarter we’ve been developing articles that meet direct asks from you, our customers, and now we want to hear which one is your favorite. Read on to find out more! This Month’s New Articles We’ve published so many interesting articles this month that it’s hard to pick a few to focus on! The definitive guide to best practices for ITSI is a comprehensive guide to best practices for Splunk ITSI. Compiled by ITSI SMEs at Splunk and designed for ITSI administrators, the guide provides essential guidelines to ensure optimal operations and an excellent end-user experience, helping you to unlock the full potential of ITSI. You'll learn recommended best practices for configuring and optimizing ITSI deployments, including data ingestion, service modeling, notable event management, and advanced analytics, and more. This guide will continue to grow, so look out for more updates in the coming months! We’re also proud to publish our first article on Splunk Mission Control. Getting started with Splunk Mission Control for unified security operations is a great guide to anyone who’s new to, or curious about, Mission Control. This article walks you through an example investigation from the perspective of a SOC analyst using Mission Control, showing you how to work with events and run automated responses with Splunk Mission Control playbooks. Getting Started with the Google Chrome App for Splunk helps SOC analysts and IT security professionals address the growing risks from risky browser behavior. Learn how to use the Google Chrome Add-on and App for Splunk to bring Chrome Threat and Data Protection events into Splunk, improve investigations with prebuilt dashboards, and automate responses such as blocking risky extensions. The step-by-steps in the article help you to configure the Splunk platform and set up the integration in Chrome Browser Cloud Management (CBCM). Finally, Managing the lifecycle of an alert is a new article that brings together several existing Lantern use cases into a complete alerts management workflow. It takes guidance from Docs and blends it with best practices and example configurations from Splunk experts, allowing you to create a comprehensive approach to managing the lifecycle of an alert, encompassing detection, triage, investigation, and remediation. Those articles are just scratching the surface of everything we’ve published this month. Here’s the full list of articles now live across Platform, Security, and Observability. Platform Routing root user events to a special index Hiding rows or panels in dashboards with XML Masking IP addresses from a specific range Running the Splunk OpenTelemetry Collector on Darwin Collecting Mac OS log files Mac OS Security Understanding the Event Sequencing engine Following best practices for designing playbooks Using a playbook design methodology Understanding SOAR case management features Customizing Enterprise Security dashboards to improve security monitoring Managing data models in Splunk Enterprise Security Optimizing correlation searches in Enterprise Security Using the workbench in an Enterprise Security investigation Comparing security domain dashboards in Enterprise Security Using protocol intelligence in Enterprise Security Observability Using SRE golden signals for KPIs Using the Monitoring and Alerting Content Pack Configuring notable event timestamps to match raw data Using the correct KPI statistical functions for alerting Limiting the number of KPIs per service Choosing KPI base searches over ad hoc searches Review alerts received when a pending state occurs Cast Your Vote in Lantern’s Customer Choice Content Competition! Lantern is running a competition for the best article created in the past quarter that answers a direct ask from you, our customers. You might have seen one of our surveys popping up on our site asking you what content you’re looking to see on Lantern, and Splunkers from around the company have been working to answer your call. We’ve chosen six articles that we’ve published over the past quarter that answer these direct customer asks - from content for working with Mac files, to GitLab content, OTel and more - and we’re asking all Splunk customers to vote on their favorite. We want to hear what you think is the most useful, the most interesting, or simply the Splunkiest out of the bunch. Cast your vote using this form by the 15th August! Preparing for certificate-based authentication changes on Windows domain controllers Running the Splunk OpenTelemetry Collector on Darwin Collecting Mac OS log files Getting GitLab CI/CD data into the Splunk platform Sending GitLab webhook data to the Splunk platform Customizing the Splunk OpenTelemetry distribution to accommodate unsupported use cases We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re spotlighting two new sets of articles designed especially for SOAR users and manufacturing customers. For everyone else, we’ve also published lots of new use cases, product tips, and data articles that cover a range of concerns across Security and Observability. Jump to the bottom of this blog to find those, or read on to find out more about our new SOAR and Manufacturing updates. The SOAR Adoption Maturity Model We’ve just published a great new resource for Splunk SOAR users who are looking to get the most value possible out of the platform.  The SOAR Adoption Maturity Model offers a comprehensive framework for implementing a complete security orchestration, automation, and response (SOAR) solution in your IT environment.  Different organizations have different needs from their SOAR implementation. If you’re an organization that has an ad hoc, distributed, or managed SOC that works in a reactive and manual way, you’ll have different needs from an organization that has a centralized SOC running a lot of proactive processes. The SOAR Adoption Maturity Model helps you assess your maturity level and links you to recommended best practices, use cases, playbooks, and applications that fit your specific needs. It also provides you with guidance on how you can strategically progress through different stages to effectively advance your security capabilities.  If you’re a SOAR user, check it out today, and let us know what you think! Manufacturing addition to the Platform Use Case Explorer Lantern’s Use Case Explorers for Security, Observability and the Splunk Platform are in constant development, with new use cases being added regularly. We’re happy to announce that we've added a suite of new use cases for Manufacturing customers to the Platform Use Case Explorer. Here’s a quick look at some of the new use cases: Identifying and quantifying your organization's carbon emissions helps you create emission monitoring dashboards that can be customized to suit your organization's needs. Identifying and visualizing supply chain issues shows you how to use the Splunk platform to visualize your supply chain and warehouse inventory, as well as how to schedule searches to automatically get updates on a regular basis. Monitoring and troubleshooting device temperature helps you ensure operational efficiency and prevent potential issues such as system overheating or outages. Monitoring equipment issues in real-time with predictive maintenance introduces you to modern equipment monitoring techniques that help you move from a traditional, reactive maintenance stance to a more proactive and strategic one. What Else? As well as everything above, over the past month we’ve published a wealth of use cases, product tips, data descriptors, and more. Here’s the full list: Security Auditing with the Splunk App for PCI Compliance Passing data between SOAR playbooks Normalizing Enterprise Security data with technology add-ons Sending events from the Splunk platform to SOAR Generating investigation lists for a virus infection Observability Correlating log data to metric charts in Observability Cloud dashboards Deciding on automatic versus manual instrumentation Customizing span metadata in Splunk APM Using business workflows in Splunk APM Optimizing application, service, and memory usage with AlwaysOn Profiling for Splunk APM Monitoring the availability of online storefronts Platform Splunk 9.0.5 FAQ Customizing the Splunk OpenTelemetry distribution to accommodate unsupported use cases Configuring Alert Actions with the Google Chrome Add On for Splunk Getting started with the Google Chrome App for Splunk Finally, the Lantern team will be at this year’s .Conf. Please come and say hi! The Lantern kiosk will be located in the Success Zone. We’d love to meet more Lantern users, get your feedback, and learn more about how we can make the site better for you. We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more