Knowledge Portal

Things to Ponder: Splunk conf files -> Lessons Learned

In a Splunk environment, Splunk operations are controlled by configuration files (conf files). Configuration of the file settings are essential to the proper running of the Splunk instance. In this article, we walk through how to properly configure the file settings to ensure that your Splunk instance is running optimally.

Read More

The Splunk UBA Journey…Q&A

UBA, User Behavior Analytics, is a Premium Splunk App that leverages machine learning technologies, to secure an organization from insider threats while also providing outsider threat monitoring and alerting capabilities. In this blog we will cover frequently asked questions around UBA and its functionality.

Read More

SPL Optimization Tips

There are countless blogs, articles, and Splunk ‘answers’ regarding the optimization of Splunk queries (and here’s another one). In this article, we are going to share a few tips to improve the performance of your Splunk queries…

Read More

Splunk API Data Ingestion

Did you know that Splunk has the capability to ingest non-log based data through multiple onboarding methods? In this blog, we will touch on API based data ingestion, as it is traditionally the most common method utilized.

Read More

What is Summary Indexing???

What is Summary Indexing? Summary indexes, as the name implies, allows for the storage of summarized data over time. This allows us to take these bite-size calculations of our data, and store those results in separate indexers.

Read More

Your Guide to Disk Migration

Many Splunk customers start with a single disk for storing Indexes and then want to make changes. In this guide we will discuss the steps to move hot/warm buckets onto faster disks and move cooler buckets to cheaper storage.

Read More