Splunk

Building Splunk Searches Using AI (GitHub Co-Pilot) A lot of time spent writing Splunk searches goes into formatting, syntax, and remembering commands or patterns for your SPL. With the help of generative AI, specifically GitHub Co-Pilot, we can significantly reduce the time spent writing searches. It also makes it easier to iterate quickly on existing searches and serves as great notes for later. I’ve edited this article about five times now, and finding the “perfect” balance of detail has been challenging. I’ll keep it simple. I think this approach will work for 90% of people starting with Co-Pilot and Splunk Searches. I think you should be able to identify more complex use cases as you get more comfortable with the tool. ...

Transparent Huge Pages (THP) is a Linux kernel feature designed to optimize memory management, but it can significantly impact the performance of certain applications. This article explores the benefits and challenges of THP, with a particular focus on its effects on Splunk performance and how to configure it appropriately for optimal system operation.

HEC (HTTP Event Collector) is a super easy way to send data into Splunk. It opens up the opportunity to quickly update a script or application to send data into Splunk without having to install a forwarder or setting up a syslog server.

Have you ever encountered a ‘missing index’ error in Splunk and worried about losing your logs? This article shows you how to set up a ’lastchance’ index to catch those wayward logs, ensuring you don’t lose data even when it’s headed for a non-existent index.

What do you do when you want to reindex logs that have already been indexed by Splunk? This article shows you how to use the ‘fishbucket’ method to reindex your data, whether you indexed it into the wrong index or forgot to create an index before applying your inputs.conf.

Don’t just give it root access! Process of onbaording Linux logs into Splunk using ACLs.

A guide to understanding the difference between a Splunk App and a Splunk Add-On.

A step-by-step guide to setting up Splunk on Windows using WSL with a free Splunk license. We also discuss the different types of Splunk licenses. This guide accompanies the video tutorial on my YouTube channel.

Splunk Admin Config Service (ACS) API is a super powerful tool that allows you to manage your Splunk Cloud instance programmatically. In this post, I’ll showcase some use cases for Splunk Cloud’s ACS API as well as provide some real-world examples.

Splunk users can apply the ut_levenshtein macro from the URL Toolbox app to compare domain names against a reference domain, enabling the detection of potential typosquatting.