Splunk’s index retention settings might seem tricky because they involve various options. If you don’t fully understand these configuration options, you could encounter problems like data being deleted too early or not being removed as expected. Let’s explore some important index retention settings in indexes.conf.

In this guide, we will go through the two main methods you can follow to delete events from Splunk.

Why Base Searches? Even when constructing a simple dashboard, you might have multiple panels that independently run their own searches within the dashboard. Splunk executes these searches separately, retrieves the results, and then displays the visualizations. This process could potentially cause the dashboard to take longer to load, as each panel completes its search individually. If these panels are based on the same initial data, utilizing a base search becomes advantageous. With a base search, the search runs once when the dashboard loads, passing its results to the panels. The panels then carry out post-processing before presenting the visualizations. ...

If you’re looking to dive into Splunk and want a dataset to work with, the BOTS v3 (Boss of the SOC) dataset is a great choice. Lets look at the process of setting up the dataset in Splunk.

This guide will walk you through the process of installing a Linux Splunk Universal Forwarder (UF) with the aim of automating the process.

In this guide, we will explore network connectivity troubleshooting using a simple use case.

Maintaining a reliable backup strategy is crucial when working with Splunk Enterprise, as it ensures the ability to revert back to a functional state in the event of an unrecoverable issue. In this article, we will explore a simple yet effective method of backing up Splunk’s /opt/splunk/etc directory.

Let’s take a look at how to set up key-based authentication for SSH. This method is useful for building scripts that require connections to other hosts or just for everyday quality of life improvements. A similar setup can be used for authenticating to a Linux host from a modern Windows installation.

When troubleshooting network connectivity issues on a Windows system, the Test-NetConnection PowerShell cmdlet can be a valuable tool. It allows you to test network connectivity to a specific host and port, providing useful information for diagnosing and resolving issues.

Tar is a widely used command-line utility for archiving and compressing files and directories on Linux systems. It provides a convenient way to create and manage compressed tar archives. Here is a handy cheat sheet for using tar with different operations.