Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re focusing on a new feedback initiative. We want to hear from you what you’d like to see on Lantern, and we’ve got swag to give away at .Conf for your ideas! As usual, we’re also sharing the full list of articles published over the past month. Read on to find out more. Share Your Use Case Ideas! Did you know that Lantern holds more than 230 use cases in our Use Case Explorer for Security and Use Case Explorer for Observability and the Use Case Explorer for Splunk Platform? While that’s a lot of use cases, we’re always on the lookout for more! So what exactly is a Lantern use case? Our use cases contain step-by-step guidance for applying Splunk software to a real business outcome to help you to self-serve and get to value faster. They might have wide interest or applicability, or they might serve more niche needs. What all of Lantern’s use cases have in common is that they contain practical guidance that you can pick up and use right away in your environment. Here are some examples of use cases within Lantern: ​​Splunk platform Security: Detecting a ransomware attack Splunk platform IT Modernization: Managing Azure cloud infrastructure Splunk SOAR: Detecting unusual GCP service account usage Infrastructure Monitoring: Monitoring Kubernetes pods  Do you have an idea for a security, observability, or industry-specific use case that you’d love to see on Lantern? Share your ideas with us! All of your ideas will inform our article development strategy for the upcoming year, and your article could be written by a Splunk expert for all Splunk customers to benefit from. To say thank you, we’re giving away some exclusive Lantern swag! Just submit an idea and be one of the first 50 visitors to the Splunk Lantern kiosk in the Success Zone at .Conf this year to claim your prize. You can submit your ideas using the form link above, or complete it at the kiosk, so start thinking about your use case ideas now! Even if you won’t be at .Conf, we’re keen to hear what use cases will help you take your Splunk usage to the next level, so please share your ideas with us today!   Spotlight on Security This past quarter, Splunk Lantern has had the pleasure of working with Professional Services (PS) Regional Security Architect David Goodin, who joined us for a job rotation. As an expert PS team member with lots of experience with working with customers, David has a lot of tips and tricks for getting the most out of Splunk software. Now, we’re happy to share them with you all through his articles! Here’s what David wrote for us this month. Properly securing Splunk indexes shows you how you can use role-based access control (RBAC) to secure your indexes and data models. It goes through some of the pros and cons of using search filters versus index restrictions to secure your Splunk instance, and explains some of the performance considerations you’d expect to see. There’s a lot of demand for articles covering federated search, and David’s article on Securing and monitoring federated search is an authoritative guide on how to ensure that federated search in your environment is properly secured and compliant. Identifying non-defensible networks with Splunk details strategies for maintaining a complete asset and identity network inventory, with tips for finding rogue machines.   Using Splunk SOAR to find gaps in your containment strategy shows you how to use Splunk SOAR to automate the containment process through the use of playbooks. Incident responders and their teams might find this use case especially helpful to strengthen their containment strategies in line with best practices. If you liked these use cases, you might also want to check out the rest of David’s articles: Using Splunk's security suite for incident response management Tracking assets when recovering from an incident Using your lessons learned from incidents to harden your SOC processes Enhancing endpoint monitoring with threat intelligence   This Month’s New Articles Here are all of the other articles that are new on Lantern, published over the month of April: Identifying and removing malicious emails with Splunk SOAR from within Microsoft 365 mailboxes Partitioning data in S3 for the best FS-S3 experience Automating the investigation of emails for malicious content Splunk Custom Visualizations App Sunset FAQ Configuring Splunk DB Connect for use with Google BigQuery Monitoring VMware components with Infrastructure Monitoring We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting a brand new set of content on Lantern. Splunk Outcome Paths show you how to achieve common goals that many Splunk customers are looking for in order to run an efficient, performant Splunk implementation. As usual, we’re also sharing the full list of articles published over the past month. Read on to find out more.   Splunk Outcome Paths   In today’s dynamic business landscape, navigating toward desired outcomes requires a strategic approach. If you’re a newer Splunk customer or looking to expand your Splunk implementation, it might not always be clear how to do this while reducing costs, mitigating risks, improving performance, or increasing efficiencies. Splunk Outcome Paths have been designed to show you all the right ways to do all of these things. Each of these paths has been created and reviewed by Splunk experts who’ve seen the best ways to address specific business and technical challenges that can impact the smooth running of any Splunk implementation. Whatever your business size or type, Splunk Outcome Paths offer a range of strategies tailored to suit your individual needs: If you’re seeking to reduce costs, you can explore strategies such as reducing infrastructure footprint, minimizing search load, and optimizing storage. Mitigating risk involves implementing robust compliance measures, establishing disaster recovery protocols, and safeguarding against revenue impacts.  Improving performance means planning for scalability, enhancing data management, and optimizing systems.  Increasing efficiencies focuses on deploying automation strategies, bolstering data management practices, and assessing readiness for cloud migration.  Choosing a path with strategies tailored to your priorities can help you get more value from Splunk, and grow in clarity and confidence as you learn how to manage your implementation in a tried-and-true manner. We’re keen to hear more about what you think of Splunk Outcome Paths and whether there are any topics you’d like to see included in future. You can add a comment below to send your ideas to our team.   Use Case Explorer Updates   Splunk Lantern’s Use Case Explorer for Security and the Use Case Explorer for Observability have become popular tools with Splunk customers looking for a framework for their Security or Observability journey. But technology changes fast, and today’s organizations are under more pressure than ever from cyber threats, outages, and other challenges that leave little room for error. That’s why on team Lantern we’ve been working hard to realign our Use Case Explorers with Splunk’s latest thinking around how to achieve digital resilience. Our Use Case Explorers follow a prescriptive path for organizations to improve digital resilience across security and observability. Each of the Explorers start with use cases to help you achieve foundational visibility so you can access the information your teams need. With better visibility you can then integrate guided insights that help you respond to what's most important. From there, teams can be more proactive and automate processes, and ultimately focus on unifying workflows that provide sophisticated and fast resolutions for teams and customers.   If you haven’t yet checked out our Use Case Explorer for Security or the Use Case Explorer for Observability, take a look today, and drop us a comment below if there’s anything you’d like to see in a future update!   This Month’s New Articles   Here’s the rest of everything that’s new on Lantern, published over the month of March: Enhancing endpoint monitoring with threat intelligence De-identifying PII consistently with hashing in Edge Processor Using lessons learned from incidents to harden your SOC processes Using ingest actions to filter AWS CloudTrail Logs Using ingest actions to filter AWS VPC Flow Logs Applying Benford's law of distribution to spot fraud Proactive Response: Orchestrate response workflows Tracking assets when recovering from an incident Proactive Response: Automate threat analysis Proactive Response: Automate containment and response actions Optimized Workflows: Automate complete TDIR life cycle Optimized Workflows: Federate access and analytics Configuring Windows event logs for Enterprise Security use Unified Workflows: Align IT and Business with Service Monitoring Guided Insights: Understand the Impact of Changes Unified Workflows: Enable Self-Service Observability Foundational Visibility: Optimize Cloud Monitoring Proactive Response: Prevent Outages Proactive Response: Debug Problems in Microservices Proactive Response: Optimize End-User Experiences Enabling Windows event log process command line logging via group policy object We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

It’s been a big news month for Splunk Lantern. Along with celebrating the publication of our 1000th article, we’ve found out that we are up for not just one, but three awards from two different awards providers! We’re thrilled that this reflects how helpful Lantern has become to so many customers, Splunkers and partners, and also shows the significance of the contributions from the expert authors who share their knowledge on Lantern. We are very proud that our team has been named Finalists in two categories in the 18th annual Stevie Awards for Sales & Customer Service. This year's competition saw more than 2,300 nominations from organizations of all sizes, in virtually every industry, and across 47 nations and territories.  We’re also celebrating having been nominated in the annual CXOne Expert Customer Recognition Awards! Read on to find out more, and please consider voting for us here!   Stevie Awards: Best Use of Thought Leadership in Customer Service   This category recognizes the promotion of thought leadership within customer service that enables customers to benefit from the unique knowledge and learnings of individuals and teams within their organizations. The Splunk Lantern website launched in Q2 of 2020 with 46 articles. Since then, Lantern has become a customer success center used widely by Splunkers, partners, and Splunk’s 15,000+ customers alike. All of Lantern’s 1000+ articles are crowdsourced from experts around Splunk, the majority of whom don’t have documentation in their job descriptions. Splunk partners also share their insights gained from real work with customers in the field. Lantern’s site metrics show that more and more users are hungry for the articles we host - between July 2021 and November 2023, Lantern saw new user metrics rise from 5,878 then to 35,842, an increase of 509%, while returning users increased from 1,707 in July 2021 to 29,580, an increase of 1,632%. If you're not one of our regular readers, why not take a moment now to check out all the great content we offer for Platform, Security, and Observability customers?     Stevie Awards: Award for Innovation in Customer Service - Computer Industries   This category recognizes new ideas and developments within customer service that enable organizations to meet the needs of their customers more effectively, leading to increased satisfaction and loyalty. At Splunk Lantern, we’re committed to providing a free platform that offers immediate value to users. We’ve significantly increased customer engagement, with a surge in unique page views from 21,767 in July 2021 to 81,469 by November 2023, representing a remarkable 274% increase. Ongoing executive support for the Splunk Lantern project shows dedication to the success of all Splunk customers, not just those who can afford expensive professional services.  Check out some of the unique content our site offers, such as Data Descriptors (comprehensive guidance for getting data in and applying data to your key use cases) and the Splunk Success Framework (best practices that you can use to create and maintain a smoothly-running Splunk implementation).     CXOne Expert Customer Recognition Awards: Innovation Award   This award recognizes the customer who has thought outside the box. This customer has developed features and functionality within their CXOne Expert site to further optimize its capabilities, as well as the efficacy of its processes. Splunk Lantern is innovative by nature. Its focus is only on customer success outcomes, and no support documentation is held on the site. We align our offerings with customer success programs to drive sales and renewals, and metrics show that our data-driven content analysis led to a 75% increase in new users and a 91.5% surge in returning users last year. Finally, Splunk Lantern is pioneering several pilot projects with CXOne Expert, with a desire to stay abreast of breakthrough functionality in our platform. You can read more about this nomination on the CXOne Expert Awards site and please consider voting for us here!   The Results    The Stevie Awards recognition underscores Splunk's commitment to excellence, innovation, and superior customer service in an ever-evolving landscape. While these awards do not have a voting component, we’re thrilled that our team will ultimately be Gold, Silver, or Bronze Stevie Award winners, and we’ll find out when the awards are unveiled on April 12th. We’re also very proud to have been recognized for the third year in a row at the CXOne Expert awards. Every vote counts in helping us secure a win, so please vote for us today! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re sharing all the details of a brand new Splunkbase app which helps you discover use cases in Lantern’s Use Case Explorer for the Splunk Platform. We’re also highlighting a batch of new Splunk Edge Processor articles that help new users learn how it works, and help more experienced users get even more value from it. As usual, we’ve also got links to every new article that we published over the month of February.  Use Case Explorer App We’re excited to announce the launch of a brand new app that makes it easier than ever for you to work with the Use Case Explorer for the Splunk Platform - the Use Case Explorer App for Splunk. This app searches your Splunk data sources and recommends use cases you can use right away, using the 350 different procedures you can find within the Use Case Explorer for the Splunk Platform. It’s a great tool for identifying new ways you can get more value out of your Splunk implementation, and it links you to the relevant articles in Lantern so you can get started easily. The Use Case Explorer content is designed to help you achieve your Security and IT Modernization goals - even if you're not using Splunk's premium security and observability products. (If you are using these products, you can check out the guidance for them within the Use Case Explorer for Security and Use Case Explorer for Observability.) The Use Case Explorer also contains a wide range of industry-specific use cases. Check out the app today, and don’t hesitate to let us know how it’s helped you by dropping a comment below! Doing More with Splunk Edge Processor This month the Lantern team has been working with experts from all across Splunk to publish new articles that highlight some of the key capabilities in Splunk Edge Processor. Here’s more info on three that we’ve published this month: Reducing Windows security event log volume with Splunk Edge Processor features a great video from the experts at Splunk Edu that shows you how Splunk Edge Processor can be used to help you better manage security event log volume. Converting logs into metrics with Edge Processor for beginners is a great place to get started if you’re new to how Edge Processor works. It shows you how to build metrics with dimensions so you can remove complexity from data, reduce resource consumption, improve data quality, and ultimately reduce mean time to identify problems. Finally, Enriching data via real-time threat detection with KV Store lookups in Edge Processor shows you how to utilize lookups to cross-reference threat intelligence data, which enhances your ability to detect and respond to cybersecurity threats in a timely and efficient manner. We’re continuing to plan even more Edge Processor articles in the future, so drop a comment below if there are any tips you’d like to see, or use cases you’d like us to cover! This Month’s New Articles Here’s the rest of everything that’s new on Lantern, published over the month of February: Customizing JMX metric collection with OpenTelemetry Enriching data via real-time threat detection with KV Store lookups in Edge Processor Rigor to Synthetics Migration Migrating from Tenable LCE to Splunk Enterprise Security Splunk IT Service Intelligence Owner's Manual Checking for event time indexing Checking for KPI search success Maintaining service entities Maintaining adaptive thresholds Monitoring for KPI search lag Splunk User Behavior Analytics (UBA) Owner's Manual Tuning anomaly rules Checking for sizing adherence Patching for operating system security Cleaning up backup file directories Validating data source integrity Implementing a reingestion pipeline for AWS logs using Kinesis Data Firehose Using Amazon SageMaker to predict risk scores We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re featuring our annual rundown of the Lantern articles that are getting the most views, as well as sharing some interesting site metrics with you from our past financial year. We’ve also published new use cases, product tips, and more! If you want to jump straight to our new articles, scroll to the bottom to find them. Splunk Lantern’s Top Articles Splunk has just ended its financial year, so here on Team Lantern we’ve been looking at our yearly metrics to see how much we’ve grown. And our growth has been amazing! Over the past financial year, Lantern has seen nearly a million unique page views - 975,940, which compared to last year’s 613K, represents a 59% increase. We’ve welcomed 314k new users to Lantern, a 75% increase year-on-year. And we have grown our passionate base of returning users to 310k, a figure that’s nearly doubled from last year’s 161k. We’re deeply proud of how we’ve grown to serve so many of you with articles that help you get more value from your Splunk implementation. While we offer hundreds of articles in dozens of areas of interest, here are the pages that came out on top with the most page views over the past year in each of our categories. We hope that you can be inspired by the same Lantern articles that inspired so many Splunk users over the past year! Security Most popular use cases published in FY24 Assessing and expanding MITRE ATT&CK coverage in Splunk Enterprise Security Protecting Operational Technology (OT) environments Detecting consumer bank account takeovers   Most popular use cases of all time Implementing risk-based alerting in Splunk Enterprise Security Using threat intelligence in Splunk Enterprise Security Assessing and expanding MITRE ATT&CK coverage in Splunk Enterprise Security Most popular product tips published in FY24 Using Threat Intelligence Management Configuring Windows security audit policies for Enterprise Security visibility Sending events from the Splunk platform to SOAR Most popular product tips of all time Using the Splunk Enterprise Security assets and identities framework Onboarding data to Splunk Enterprise Security Configuring Windows security audit policies for Enterprise Security visibility Platform Most popular use cases published in FY24 Detecting malicious activities with Sigma rules Monitoring major Cloud Service Providers (CSPs) Building a data-driven law enforcement strategy Most popular use cases of all time Detecting a ransomware attack Monitoring for network traffic volume outliers Investigating a ransomware attack Most popular product tips published in FY24 Replacing null values by using the fillnull and filldown commands Using ingest actions in Splunk Enterprise Working with multivalue fields Most popular product tips of all time Writing better queries in Splunk Search Processing Language Replacing null values by using the fillnull and filldown commands Using ingest actions in Splunk Enterprise   Observability Most popular use cases published in FY24 Managing the lifecycle of an alert: from detection to remediation Identifying DNS reliability and latency issues Monitoring availability and performance in non-public applications Most popular use cases of all time Managing the lifecycle of an alert: from detection to remediation Monitoring Kubernetes pods Monitoring API transactions Most popular product tips published in FY24 Getting started with the Microsoft Teams Add-on for Splunk Collecting Mac OS log files Getting Docker log data Into Splunk Cloud Platform with OpenTelemetry Most popular product tips of all time Getting started with Microsoft Azure Event Hub Getting started with the Microsoft Teams Add-on for Splunk Installing Splunk Connect For Syslog (SC4S) on a Windows network Huge thanks is due to all of our contributors who share their helpful knowledge through our articles. If you're a Splunker who could write an article for us that might make it into our most popular lists next year, then drop us a comment below! This Month’s New Articles Here’s the complete list of everything that’s new on Lantern, published over the month of January: Splunk 9.1.3 FAQ Using Admin Config Service (ACS) in Splunk Cloud Platform FedRAMP environments Migrating to Mission Control Converting complex data into metrics with Edge Processor Using Dashboard Studio inputs in the canvas Using the events viewer visualization in Dashboard Studio Showing and hiding Dashboard Studio elements based on data availability Converting a Classic dashboard to Dashboard Studio Using the Link to Search and Link to Reports interactions in Dashboard Studio Configuring the trellis layout in Dashboard Studio We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting a new video that shows you all the ways Lantern can help you to achieve success. We’ve also published a new section of our Use Case Explorer for the Splunk Platform with brand new use cases relevant for energy sector customers. And as usual, we’re also sharing the rest of the new articles we’ve published this month. Read on to see what’s new. Lantern: Lighting Your Success with Splunk Did you know that Lantern holds nearly a thousand different articles for users of the core platform, plus premium Security and Observability products? Our articles cover everything from the basics of getting started with Splunk for newer users, to more advanced tips to help you work with Splunk like a pro, all the way through to the guidance provided by the Splunk Success Framework to help you operate Splunk as a program in your organization. Whether you’re a user or an admin, new or experienced, and whatever your goals, we’re confident that Lantern has helpful guidance for you. Watch our new 5-minute video for an overview of all of our different types of articles to get up to date with where to find articles that’ll help take your Splunk usage to the next level. Platform Use Cases for Energy Customers The Use Case Explorer for the Splunk Platform helps you develop new use cases using either Splunk Enterprise or Splunk Cloud Platform. The Explorer gives you an easy way to access use cases that are especially relevant for particular industries, such as Finance, Healthcare, Public Sector and more. We’ve just updated the Use Case Explorer with a new section for Energy sector customers. This section contains a number of use cases with searches that are specific to Operational Technology environments, allowing you to improve the security of these environments and ensure compliance with key legislation.  If you’re an energy customer, be sure to bookmark this page - we’ll be adding to it over the coming weeks with more energy-specific content, including new guidance on using Splunk Edge Hub with energy meters. Let us know what you think and what other use cases you’d like to see by dropping a comment below! Everything Else New This Month Here are all of the new articles that we’ve published this month: Protecting Operational Technology (OT) environments Reducing PAN and Cisco security firewall logs with Splunk Edge Processor Detecting Operational Technology assets communicating with external systems Using the OT Security add-on for Splunk to ensure NERC CIP compliance Sharing data between Splunk IT Service Intelligence and Splunk Enterprise Security Using Splunk DataSense Navigator Safeguarding Workload Management operation during the transition to cgroups v2 We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting our new Getting Started Guide that tells you everything you need to know about using Splunk Edge Processor. As usual, we’re also sharing the rest of the new articles we’ve published this month. Read on to see what’s new. Getting Started with Splunk Edge Processor Lantern provides comprehensive Getting Started Guides for all of Splunk’s products across the platform, plus premium Security and Observability products. Our Getting Started Guides are great for onboarding new users, but even if you’re more experienced they can be a great help to ensure you haven’t missed any essential steps or key resources that can help you use our products smoothly and efficiently. This month, we’ve published Getting Started with Splunk Edge Processor. Edge Processor is designed to help you achieve greater efficiencies in data transformation close to the data source and improved visibility into data in motion. If you’re curious about how Edge Processor can help you, our guide can give you a great intro into what’s needed. Check it out to see how easy it is to get started. Machine Learning Toolkit Articles The Splunk Machine Learning Toolkit (MLTK) provides hundreds of thousands of Splunk customers with SPL commands, custom visualizations, assistants, and examples to explore a variety of machine learning concepts.  This month, we’ve published two new articles to help MLTK users get even more out of this powerful app. Preparing data for use with the Machine Learning Toolkit (MLTK) walks you through how to use basic, intermediate, or advanced patterns with the MLTK to help improve your existing or future workflows. Predicting failed trade settlements is a use case for financial services customers, showing how to use the MLTK to predict trade settlement failures and ensure compliance to the T+1 compliance directive. Looking for more MLTK articles on Lantern? Click through to see all of our articles. Everything Else New This Month Here are the rest of the new articles that we’ve published this month: Splunk 9.1.2 FAQ Enabling an audit trail from Active Directory Reducing Smartstore cache churn with smart Workload Management rules Benchmarking website performance against competitors Using comparative testing to drive app performance Using metrics to create KPIs in Splunk ITSI Predicting failed trade settlements Incorporating performance testing into the software development lifecycle We hope you’ve found this update helpful. Thanks for reading! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting some great new updates to our Getting Started Guide for Enterprise Security (ES) that provide you with easy ways to get going on this powerful platform, as well as new data articles for MS Teams. As usual, we’re also sharing the rest of the new articles we’ve published this month. Read on to see what’s new. Getting Started with Splunk Enterprise Security Lantern hosts Getting Started Guides for all of Splunk’s products across the platform, plus premium Security and Observability products. Our Getting Started Guides are great for onboarding new users, but even if you’re more experienced they can be a great help to ensure you haven’t missed any key steps or resources that can help you take your product usage to the next level. This month, we’ve been busy updating our Getting Started Guide for Enterprise Security. This new guide now features new videos from Splunk experts walking you through how to use Enterprise Security dashboards, new guidance on how to find and adopt use cases, and links to all of the resources you’ll need to be successful with ES. You can use our updated Getting Started Guide as your comprehensive toolkit for mastering Enterprise Security effortlessly. Check it out to see how you can enhance your security posture and stay ahead of challenges with our expert guidance at your fingertips. Microsoft Teams Data Articles We’ve also published some helpful configuration guidance for users of the Microsoft Teams Add-on for Splunk. This add-on collects Teams call record data, and our guide on Getting started with the Microsoft Teams Add-on for Splunk shows you how to retrieve that data. Once you’re set up, you can check out the guides Getting started with Microsoft Teams call record data and Getting started with Microsoft Teams call record data and Azure Functions to learn how call record data is made available, and how best to utilize the data. Everything Else New This Month Here are the rest of the new articles that we’ve published this month: Automating Know Your Customer continuous monitoring requirements Integrating REST endpoints with On-Call Monitoring major Cloud Service Providers (CSPs) Getting started with the Google ChromeOS App for Splunk We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting two sets of articles that illustrate how you can effectively use multiple parts of the Splunk product suite to solve some of your most crucial observability problems. These articles show you the synergies between Splunk products and features, showcasing how they work together to enhance your outcomes beyond each product’s individual parts. We’ve also published a handful of other new articles this month - jump to the bottom to see everything new. Empowering Engineers with Unified Observability Splunk Observability Cloud is a seriously powerful package, giving you the benefits of Splunk APM, Splunk RUM, Splunk Infrastructure Monitoring, Splunk Incident Intelligence, and Splunk Log Observer Connect, all in one interface. Thanks to Lantern’s Use Case Explorer for Observability, you can easily access use cases for all of these separate Splunk products. But sometimes, it might not be too clear how these products fit together. Splunk Lantern’s new article, Empowering engineers with unified observability, shows you how you can use every part of Splunk Observability Cloud to solve key problems in cloud-native environments. We’ve developed four key unified observability use cases that can empower engineers at your organization: Business impact of changes Problems in cloud-native environments Self-service observability Visibility between on-premises and cloud Each of these use cases contains written and video guidance on how you can use the different parts of Splunk Observability Cloud in concert to solve these issues. Dive in today and revolutionize your approach to unified observability! Using OpenTelemetry to Get Log Data into Splunk Cloud Platform Once you’ve got correlated log, trace, and metric data in Splunk Observability Cloud, you can use this to troubleshoot application issues in a very rapid and efficient way. But it can be tricky to work out how best to get log data flowing through to Splunk Observability Cloud in the first place. Our new article, Using OpenTelemetry to get data into Splunk Cloud Platform, lays out an effective process for this. First, you’ll see how to set up the OpenTelemetry Demo application with Docker or Kubernetes, then get that log data into Splunk Cloud Platform. Once you’ve done that, you’ll learn how to use Splunk Log Observer Connect to bring the data into Splunk Observability Cloud. The outcome of this process is you’ll have a very efficient way to troubleshoot your application issues with full log, metric, and trace visibility, and we also show you three different processes you can use to troubleshoot. We’re eager to hear if you have any questions about these articles, or if you’d like to see log collection approaches for environments other than Docker and Kubernetes - drop us a comment below to share your thoughts. This Month’s New Articles We’ve also published a few other articles over the past month that cover other interesting product tips, use cases and more. Here’s the list: Introduction to the Splunk Distributed Deployment Server (SDDS) Configuring Windows security audit policies for Enterprise Security visibility Data descriptor: Docker Configuring Splunk 9.0 for Native Common Access Card (CAC) Authentication Using Session Replay in Splunk RUM We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re highlighting some significant changes to our Use Case Explorer for Security and Use Case Explorer for Observability, aligning them with Splunk’s new prescriptive value paths for resilience so the use cases you need to drive resilience in your organization are easier than ever to implement. As usual, we’re also sharing the complete list of articles that Lantern has published over the past month. Read on to find out more.  Your Path to Greater Resilience for Security and Observability You’ve probably heard a lot about digital resilience if you attended .conf23, or if you’ve been keeping up with Splunk’s blog. Splunk offers a prescriptive path for organizations to improve digital resilience across security and observability that starts with foundational visibility to access the information teams need. With better visibility, they can prioritize actions and respond to what's most important. From there, teams can be more proactive and automate processes, and ultimately focus on optimizing digital experiences for teams and customers. But helping your own organization down this path isn’t always easy. You might not know where to start, or how to implement the use cases that will ultimately drive your overall resilience. That's where Splunk Lantern’s newly-revised Use Case Explorers for Security and Observability come in. The Use Case Explorers provide you with a structured framework and actionable guidance you can follow to develop digital resilience, wherever your organization is in its data journey. Supercharging Security The Use Case Explorer for Security shows you how to build foundational visibility in your organization through getting the basics right: gathering data in the right way and using tools like Splunk Security Essentials to build a foundational security monitoring program. From there, you'll find out how tools like Splunk Enterprise Security and Splunk SOAR can help you efficiently deal with cyber threats, as well as build modern alerting systems that help you stay on top of issues. When you've learned all this, you'll be able to see how to use Splunk Mission Control to access all your security information in one place, and spot the trends and insights that will help you build and maintain great customer relationships. Optimizing Observability The foundation of the Use Case Explorer for Observability lies in establishing strong observability basics like analyzing logs, which can be done right away in the Splunk platform. Then, as you progress, learn how to use Splunk IT Service Intelligence to gauge the health of services and extract valuable insights from events. You’ll see how to use tools like Splunk APM, Splunk Infrastructure Monitoring, and Splunk On-Call to monitor and manage your systems, identifying and addressing issues with greater ease. Then, to deliver outstanding digital customer experiences, you’ll see how to use Splunk Synthetic Monitoring and Splunk Real User Monitoring to craft experiences that resonate positively with your customers. How to Begin Ready to start? Click through to the Use Case Explorer for Security or the Use Case Explorer for Observability to start learning more. New Prescriptive Adoption Motions This month we’re happy to announce that we’ve published two new sets of Prescriptive Adoption Motions to accompany our existing Prescriptive Adoption Motions for Security with Splunk. Prescriptive Adoption Motions for Observability with Splunk are written by Splunk’s observability experts to help you confidently implement use cases by leveraging proven practices and tailored strategies. Using them helps ensure that your organization not only realizes the full value of Splunk's observability solutions, but also continues to reap their benefits in the long run. Here’s the complete list of new guides for you to browse: Business Service Insights Event Analytics Infrastructure Monitoring Application Monitoring Digital Experience Monitoring We’ve also published two Prescriptive Adoption Motions for the Splunk platform: Using the Splunk platform for Security use cases, and Using the Splunk platform for Observability use cases. These guides help you learn how you can use the core platform to build foundational security and observability processes, without using any of Splunk’s premium security or observability products. Check them out, and let us know what you think! This Month’s New Articles Here are the rest of Lantern’s newly-published articles now live across Platform, Security, and Observability: Reviewing your ITSI environment Deploying predictive analytics at the right time Adopting ITSI capabilities strategically Splunk 9.1.1 FAQ Accessing search history Using the makeresults command Planning an organizational on-call policy Using On-Call reporting to improve your team performance We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re sharing all the new articles we’ve published over the past month, with lots of interesting new use cases, product tips, and data articles. We’re also asking for your vote in our Customer Choice Content Competition - over the quarter we’ve been developing articles that meet direct asks from you, our customers, and now we want to hear which one is your favorite. Read on to find out more! This Month’s New Articles We’ve published so many interesting articles this month that it’s hard to pick a few to focus on! The definitive guide to best practices for ITSI is a comprehensive guide to best practices for Splunk ITSI. Compiled by ITSI SMEs at Splunk and designed for ITSI administrators, the guide provides essential guidelines to ensure optimal operations and an excellent end-user experience, helping you to unlock the full potential of ITSI. You'll learn recommended best practices for configuring and optimizing ITSI deployments, including data ingestion, service modeling, notable event management, and advanced analytics, and more. This guide will continue to grow, so look out for more updates in the coming months! We’re also proud to publish our first article on Splunk Mission Control. Getting started with Splunk Mission Control for unified security operations is a great guide to anyone who’s new to, or curious about, Mission Control. This article walks you through an example investigation from the perspective of a SOC analyst using Mission Control, showing you how to work with events and run automated responses with Splunk Mission Control playbooks. Getting Started with the Google Chrome App for Splunk helps SOC analysts and IT security professionals address the growing risks from risky browser behavior. Learn how to use the Google Chrome Add-on and App for Splunk to bring Chrome Threat and Data Protection events into Splunk, improve investigations with prebuilt dashboards, and automate responses such as blocking risky extensions. The step-by-steps in the article help you to configure the Splunk platform and set up the integration in Chrome Browser Cloud Management (CBCM). Finally, Managing the lifecycle of an alert is a new article that brings together several existing Lantern use cases into a complete alerts management workflow. It takes guidance from Docs and blends it with best practices and example configurations from Splunk experts, allowing you to create a comprehensive approach to managing the lifecycle of an alert, encompassing detection, triage, investigation, and remediation. Those articles are just scratching the surface of everything we’ve published this month. Here’s the full list of articles now live across Platform, Security, and Observability. Platform Routing root user events to a special index Hiding rows or panels in dashboards with XML Masking IP addresses from a specific range Running the Splunk OpenTelemetry Collector on Darwin Collecting Mac OS log files Mac OS Security Understanding the Event Sequencing engine Following best practices for designing playbooks Using a playbook design methodology Understanding SOAR case management features Customizing Enterprise Security dashboards to improve security monitoring Managing data models in Splunk Enterprise Security Optimizing correlation searches in Enterprise Security Using the workbench in an Enterprise Security investigation Comparing security domain dashboards in Enterprise Security Using protocol intelligence in Enterprise Security Observability Using SRE golden signals for KPIs Using the Monitoring and Alerting Content Pack Configuring notable event timestamps to match raw data Using the correct KPI statistical functions for alerting Limiting the number of KPIs per service Choosing KPI base searches over ad hoc searches Review alerts received when a pending state occurs Cast Your Vote in Lantern’s Customer Choice Content Competition! Lantern is running a competition for the best article created in the past quarter that answers a direct ask from you, our customers. You might have seen one of our surveys popping up on our site asking you what content you’re looking to see on Lantern, and Splunkers from around the company have been working to answer your call. We’ve chosen six articles that we’ve published over the past quarter that answer these direct customer asks - from content for working with Mac files, to GitLab content, OTel and more - and we’re asking all Splunk customers to vote on their favorite. We want to hear what you think is the most useful, the most interesting, or simply the Splunkiest out of the bunch. Cast your vote using this form by the 15th August! Preparing for certificate-based authentication changes on Windows domain controllers Running the Splunk OpenTelemetry Collector on Darwin Collecting Mac OS log files Getting GitLab CI/CD data into the Splunk platform Sending GitLab webhook data to the Splunk platform Customizing the Splunk OpenTelemetry distribution to accommodate unsupported use cases We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re spotlighting two new sets of articles designed especially for SOAR users and manufacturing customers. For everyone else, we’ve also published lots of new use cases, product tips, and data articles that cover a range of concerns across Security and Observability. Jump to the bottom of this blog to find those, or read on to find out more about our new SOAR and Manufacturing updates. The SOAR Adoption Maturity Model We’ve just published a great new resource for Splunk SOAR users who are looking to get the most value possible out of the platform.  The SOAR Adoption Maturity Model offers a comprehensive framework for implementing a complete security orchestration, automation, and response (SOAR) solution in your IT environment.  Different organizations have different needs from their SOAR implementation. If you’re an organization that has an ad hoc, distributed, or managed SOC that works in a reactive and manual way, you’ll have different needs from an organization that has a centralized SOC running a lot of proactive processes. The SOAR Adoption Maturity Model helps you assess your maturity level and links you to recommended best practices, use cases, playbooks, and applications that fit your specific needs. It also provides you with guidance on how you can strategically progress through different stages to effectively advance your security capabilities.  If you’re a SOAR user, check it out today, and let us know what you think! Manufacturing addition to the Platform Use Case Explorer Lantern’s Use Case Explorers for Security, Observability and the Splunk Platform are in constant development, with new use cases being added regularly. We’re happy to announce that we've added a suite of new use cases for Manufacturing customers to the Platform Use Case Explorer. Here’s a quick look at some of the new use cases: Identifying and quantifying your organization's carbon emissions helps you create emission monitoring dashboards that can be customized to suit your organization's needs. Identifying and visualizing supply chain issues shows you how to use the Splunk platform to visualize your supply chain and warehouse inventory, as well as how to schedule searches to automatically get updates on a regular basis. Monitoring and troubleshooting device temperature helps you ensure operational efficiency and prevent potential issues such as system overheating or outages. Monitoring equipment issues in real-time with predictive maintenance introduces you to modern equipment monitoring techniques that help you move from a traditional, reactive maintenance stance to a more proactive and strategic one. What Else? As well as everything above, over the past month we’ve published a wealth of use cases, product tips, data descriptors, and more. Here’s the full list: Security Auditing with the Splunk App for PCI Compliance Passing data between SOAR playbooks Normalizing Enterprise Security data with technology add-ons Sending events from the Splunk platform to SOAR Generating investigation lists for a virus infection Observability Correlating log data to metric charts in Observability Cloud dashboards Deciding on automatic versus manual instrumentation Customizing span metadata in Splunk APM Using business workflows in Splunk APM Optimizing application, service, and memory usage with AlwaysOn Profiling for Splunk APM Monitoring the availability of online storefronts Platform Splunk 9.0.5 FAQ Customizing the Splunk OpenTelemetry distribution to accommodate unsupported use cases Configuring Alert Actions with the Google Chrome Add On for Splunk Getting started with the Google Chrome App for Splunk Finally, the Lantern team will be at this year’s .Conf. Please come and say hi! The Lantern kiosk will be located in the Success Zone. We’d love to meet more Lantern users, get your feedback, and learn more about how we can make the site better for you. We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re spotlighting some new types of articles on Lantern - our new Prescriptive Adoption Motions for Security, plus a war story spotlighting how our partners work with Splunk to achieve best-in-class incident management. As usual, we’re also sharing all of the new content that got published over the past month. Read on to find out more. Prescriptive Adoption Motions for Security It’s not always easy to implement new security use cases. Threats evolve constantly, requiring your organization to maintain a strong security posture by utilizing the best technical expertise, best practices, and industry-specific knowledge.  Lantern’s new Prescriptive Adoption Motions for Security are designed to help. We’ve created nine adoption motions that lay out robust approaches to implementing a range of common security practices, from correlating diverse data sources to implementing risk-based alerting.  Our motions have been written by Splunk’s security experts to help you confidently implement use cases by leveraging proven practices and tailored strategies. Using them helps ensure that your organization not only realizes the full value of Splunk's security solutions, but also continues to reap their benefits in the long run. Check out the Prescriptive Adoption Motions and let us know what you think! War story - Responding to incidents with the Splunk platform and Fox-IT's Dissect In cybersecurity, war stories are a valuable tool to provide insights, lessons learned, and best practices for handling security incidents. We’re happy to be able to share our first war story, written in conjunction with Splunk partner Fox-IT: Responding to incidents with the Splunk platform and Fox-IT's Dissect. The war story shows the successful integration of Splunk and Fox-IT's Dissect framework in the context of resolving complex and rapidly evolving security incidents. The story takes you through the first 72 hours of the incident, highlighting the actions taken by Fox-IT's team and the benefits derived from the integration.  By comparing their incident response process with your own, you can gain valuable insights into enhancing your own capabilities. We’re happy to be able to share this new type of learning with you - stay tuned for more like this in the future! What Else? This month we’ve also published several other helpful new articles on a variety of topics: Getting started with Splunk Security Essentials GitLab data descriptor Getting GitLab CI/CD data into the Splunk platform Sending GitLab webhook data to the Splunk platform Preparing for certificate-based authentication changes on Windows domain controllers Demo - Log analytics for troubleshooting with IT Essentials We hope you’ve found this update helpful. Thanks for reading! - Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we're excited to announce the release of fresh video content on Splunk Lantern, created in collaboration with Splunk Education. These videos showcase seasoned Splunk professionals discussing popular, customer-requested topics with product demos that show how to implement their recommendations. In addition to this new video series, we've also published a wealth of new informative articles this month, including a whole series of use cases for telecommunications organizations. Keep reading to learn more. Get Smart: New Splunk Education Videos Ingest actions is always a popular topic on Splunk Lantern, so we’ve happy to share this new video on Using ingest actions in Splunk Enterprise. If you need to be able to mask and filter your data easily, ingest actions are a great way to achieve this, allowing you to quickly author, preview, and deploy transformation rules at ingest time.  We’ve also created some useful new content in our Splunk Enterprise Security Getting Started path. Eligible AWS customers in select US regions can now access Splunk Threat Intelligence Management for threat matching to Splunk Enterprise Security (Cloud). Our new page Using Threat Intelligence Management explains how this works, with a rundown of how to configure this new feature. If you’re a fan of learning new ways to create better SPL, you’ll enjoy our other videos that teach you how to use the commands fillnull and filldown, highlight, and top and rare. These videos provide practical guidance on how to get the most out of these commands, with examples of how they can be applied. We’ve also got a new article on Prioritizing scheduled searches, which helps you define which search or report should take precedence if you’re running a lot of them concurrently. And that’s not all! Check out some of the other videos we’ve published this month: Adding trigger conditions to alerts Solving data quality issues Using the deployer Making Connections: Telecoms Use Cases Back in February, Lantern released the Use Case Explorer for the Splunk Platform - a great tool to help you implement new use cases using either Splunk Enterprise or Splunk Cloud Platform. It contains use cases that have been developed for five key industries - Financial Services, Healthcare, Retail, Technology, Communications and Media, and Public Sector. We’re happy to announce that we’ve updated our Technology, Communications and Media category with some great new use cases specifically for Telecommunications organizations. If you work in this sector, check out these articles to see how the Splunk platform can help you achieve the following use cases: Managing prepaid mobile services Managing telecommunications content delivery Analyzing telecommunications subscriber services Monitoring usage of wireless access points If these interest you and you want to learn more, contact your account team for a demo. Even More Use Cases Lantern has published lots of other use cases, product tips, and more over the past month. Here’s the full list! Using risk scores to improve decision-making Securing the Splunk platform with TLS Splunk Adoption Maturity - Incident management Detecting Log4j remote code execution Ingesting non-standard data for law enforcement search warrant returns What Else? We are very happy to announce that Splunk Lantern won the Expert award in the Nice CXOne Customer Recognition Awards! This award recognizes that Lantern is an innovative and expert-level customer knowledge resource. There were a lot of nominees in this category, so we’re thrilled to be recognized as the leader of the pack! We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re sharing some interesting metrics with you from our past financial year, with a spotlight on the articles that got the most views. We’ve also published new use cases, product tips, and more! If you want to jump straight to our new articles, scroll to the bottom to read more. Lantern’s Top Article Metrics Splunk has just ended its financial year, so here on Team Lantern we’ve been busy looking at our metrics over the period to see how we’ve grown. And our growth has been tremendous! Over the past financial year we’ve welcomed around 350k new users to Lantern, a 314% change year-on-year. We’ve also built a passionate base of almost 165k returning users, a 687% increase. And over the year all of our users viewed a huge 760k pages.  We’re incredibly proud of how we’ve grown to serve so many of you with articles that help you get more out of Splunk. While we hold hundreds of articles, here are the use case articles that came out on top with the most page views in each of our categories. We hope that you can be inspired by the same use cases that inspired so many Splunk users over the past year! Security Most popular use cases published in FY23 Monitoring DNS queries Monitoring NIST SP 800-53 rev5 control families Detecting password spraying attacks within Active Directory environments Most popular use cases of all time Investigating a ransomware attack Monitoring for network traffic volume outliers Monitoring a network for DNS exfiltration Platform Most popular data descriptors published in FY23 Getting started with Microsoft Azure Event Hub data Blockchain data Configuring Google Workspace as a SAML IdP with Splunk Cloud Platform Most popular data descriptors of all time Microsoft data Intrusion detection and prevention data Firewall data Observability Most popular use cases published in FY23 Monitoring AWS Relational Database Services Monitoring Snowflake database usage Monitoring the user experience with web page performance Most popular use cases of all time Monitoring Windows account access Managing Cisco IOS devices Monitoring VMware virtualization infrastructure Huge thanks is due to all of our contributors who share their helpful knowledge through our articles. If you're a Splunker who could write an article for us that might make it into our most popular lists next year, then drop us a comment below! This Month’s New Articles Team Lantern has been busy this month with several reorganization and recategorization efforts to make Lantern easier to navigate and use. But we’ve still published some great new articles over the month. Here are a few highlights: Our Use Case Explorer for Security has been updated with a new Adoption Maturity Guide for Threat Intelligence to help you prepare for, implement, and measure threat intelligence processes in your organization. Ingesting Google Cloud data into Splunk using command line programs follows the Unix philosophy of "do one thing and do it well" by showing you how to use small, single-purpose tools, then how to combine them to accomplish more complex tasks and gain useful insights about your Google Cloud environment. Using ingest actions with source types that are renamed with props or transforms sheds light on how to solve a common issue with the ingest actions preview UI, with a number of choices for configuration in your environment.  Here are the rest of the helpful articles we published in March: Troubleshooting compatibility issues between components or apps in Splunk Enterprise Troubleshooting data not coming in from a Universal Forwarder in Splunk platform Combining multiple data sources in SPL Working with multivalue fields Checking the quality of your data sources Troubleshooting high resource usage in Splunk Enterprise Automating Splunk Platform administration with a Continuous Configuration Automation framework What Else? If you didn’t catch our last blog, Splunk Lantern has been nominated for not one, but two awards in the second annual CXOne Expert Customer Recognition Awards! We have been recognized in both the Expert and Innovation categories. Read on to find out more, and vote for us here before April 6! We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Are you ready for some exciting news? Splunk Lantern has been nominated for not one, but two awards in the second annual CXOne Expert Customer Recognition Awards! We have been recognized in both the Expert and Innovation categories. Read on to find out more, and vote for us here! Our nomination for the Expert Award recognizes our leadership in CXOne Expert site utilization. It acknowledges that our site is optimized to advance business goals and objectives, such as overall customer product satisfaction and adoption. So why is Lantern in the running for this category? Well, Lantern’s content is designed to replicate the type of help a customer would get from a customer success manager, professional services, or other paid options that not all customers have. We crowdsource expertise from customer-facing Splunkers and partners, then capture their knowledge in our articles. Last year, we used a number of site features to assist us in crowdsourcing from over one hundred different contributors to create more prescriptive content experiences that guide less experienced Splunk users through specific stages of their customer journeys in security, observability, or specific industries, and to collaborate across the business on customer success campaigns that share Lantern content. A survey of 92 Splunk Lantern users conducted at the end of our last fiscal year indicates a 90.2% customer satisfaction rate with the content found on Splunk Lantern and our returning users increased 687% from the previous fiscal year. Watch this video to learn more.   Meanwhile, our nomination for the Innovation Award recognizes the features and functionality we have developed within our CXOne Expert site to further optimize its capabilities and the efficacy of its processes. Team Lantern is a pretty small team, so it’s essential for us to be innovative and think outside the box to make a huge impact for our customers. In 2022, Lantern invested in site customizations that have brought a number of benefits to our users. The new fully Splunk-branded homepage features a constantly updated display of recently-published, high-value articles to keep repeat customers inspired and engaged with product possibilities. It also allows customers to quickly access articles that fit their use cases, as well as find content relevant to their stage of the customer journey. Furthermore, the homepage makes heavily trafficked content, such as the Splunk Success Framework, easily accessible.  Additional customizations, such as Splunk-styled buttons, provide a better navigation experience in long articles or articles that are part of prescriptive learning paths. The new left-navigation menu allows customers to scan a section for all articles, which might otherwise be buried several layers down. Finally, expanded use of classifications and author attributions give customers more ways to find the information they want, especially as it relates to a specific industry or expertise. Watch this video to learn more. We are incredibly excited to have been nominated for both of these awards. We encourage you to check out our site, share it with your customers and prospects, and, of course, vote for us here! Please get your vote in before the 6th April, when voting ends. Thank you for your support! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re excited to announce that the Use Case Explorer for the Splunk Platform has arrived! This new tool is designed to inspire as you develop new use cases using either Splunk Enterprise or Splunk Cloud Platform. We’ve also published a ton of new content covering a huge range of products, use cases, and industries! If you want to jump straight to our new articles, scroll to the bottom to read more.   Use Case Explorer for the Splunk Platform Whether you're a seasoned Splunk user or just getting started, the Use Case Explorer for the Splunk Platform is a great tool to help you implement new use cases using either Splunk Enterprise or Splunk Cloud Platform. It contains use cases that have been developed for five key industries - Financial Services, Healthcare, Retail, Technology Communications and Media, and Public Sector. Each of these industries operates in unique environments, with distinct challenges, so our use cases are carefully-tailored to fit these needs. Financial services, for example, holds a number of use cases to help customers detect fraud via ATMs, credit cards, and wire transfers. Healthcare contains guidance on maintaining HIPAA compliance. Or if you're looking to get inspired by a public sector use case, check out how NASA's ISS uses the Splunk platform to monitor metrics in its unique physical spaces. But wait, there's more! The Use Case Explorer also contains a plethora of use cases designed to help you achieve your Security and IT Modernization goals - even if you're not using Splunk's premium Security and Observability products. (If you are using these products, you can check out the guidance for them within the Use Case Explorer for Security and Use Case Explorer for Observability.) Like every use case in Lantern, every article comes with actionable, step-by-step guidance that you can follow to implement new use cases right away in your own environment. Head on over to the Use Case Explorer for the Splunk Platform now and see for yourself. Happy exploring!   Awesome New Articles Team Lantern, along with experts from all across Splunk, have been working their tails off this month to publish a heap of new articles for you to explore. We're talking use cases galore and a huge range of tips that will make your head spin (in a good way, we promise!) Here are a few to start with: Our Use Case Explorer for Security has undergone a number of new updates, with new Adoption Maturity guides to help you prepare for, implement, and measure a number of critical security outcomes. See the new guides here: Threat intelligence Risk-based alerting Automation and orchestration Cyber frameworks Data sources & normalization If you’re interested in learning about using MITRE ATT&CK with Splunk Enterprise Security, check out another new Use Case Explorer for Security article on Assessing and expanding MITRE ATT&CK coverage. It contains SPL queries you can run to assess your coverage, and step-by-steps you can follow to quickly expand it.  We’ve also made a few updates to the Use Case Explorer for Observability. Identifying DNS reliability and latency issues and Monitoring availability and performance in non-public applications are two new articles that help Splunk Infrastructure Monitoring users investigating Kubernetes network issues, and Splunk Synthetic Monitoring users who want to improve digital experience. We’re excited to have launched a new Getting Started Guide: Getting Started Guide for Log Observer Connect. Log Observer Connect is an integration that allows logs on Splunk Enterprise or Splunk Cloud Platform to be queried and associated with Related Content in Splunk Observability Cloud. This guide shows you how to get it set up, from ingesting logs to verifying success. Finally, Lantern is a home for FAQs relating to Splunk Enterprise upgrades, and we’ve released a Splunk 9.0.4 FAQ that addresses all the main questions you’ll have about updating to this version. Those are just a few highlights of what’s been published on Lantern this month. Here’s everything else that we haven’t mentioned yet: Building a data-driven law enforcement strategy Identifying DNS reliability and latency issues Detecting malicious activities with Sigma rules Setting data retention rules in Splunk Cloud Platform Securing infrastructure-as-code with Zscaler Posture Control Data source: JupiterOne Optimizing and automating SecOps with JupiterOne Leveraging critical vulnerability insights for effective incident response Setting up deployment server apps for the enterprise environment We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re excited to announce the relaunch of the Splunk Success Framework, a comprehensive resource for Splunk program managers to create best-practice processes for Splunk implementation. While we’ve been heavily focused on updating this tool, we’ve also got some new articles to share with you. Read on to find out more. The Splunk Success Framework Being a Splunk program manager is an exciting role with a lot of responsibility. Helping your organization implement Splunk for the first time, or expand its investment in Splunk, means you play a big part in helping your organization realize maximum value. While your organization’s experts in using Splunk are busy with the technicalities of configuring the software, you need to form a plan for implementation. Your plan should make it easy for you to manage Splunk on a day-to-day basis, while ensuring that value is delivered from now to the future. Some of the things you’ll need to do include: Learn how to manage stakeholders and conduct effective QBRs that demonstrate the value of the purchase  Make sure your deployment is appropriately staffed and that the staff have access to training and understand their roles Understand the capacity of your deployment and have a backup and restoration plan prepared in case of failure Create processes for logging and data onboarding so everyone in the organization can get the value they need out of the Splunk platform With the Splunk Success Framework, you'll have access to a system of best practices that will help you meet these needs, helping you unleash the full potential of your data with Splunk. This comprehensive framework has been updated to include a brand-new Fundamentals section, improved navigation, and fresh tips from Splunk experts. The four functional areas covered in the framework include program management, people management, platform management, and data lifecycle management. The best practices in the framework are flexible and modular, allowing you to tailor them to your organization's unique requirements.  Organizations implementing Splunk from scratch can have different needs than those who have been working with Splunk for some time. Because of this, all of the best practices within the framework are aligned with three adoption levels appropriate to your organization’s stage of its Splunk journey - standard, intermediate, and advanced - so you can choose the one that best fits your priorities, needs, and goals.     The Splunk Success Framework has been designed by experts at Splunk who have overseen scores of customer implementations and seen first-hand what works best. All of these learnings are captured within the framework to help you implement Splunk successfully, get value more quickly, and enable your organization to think differently about data and its potential. Check out the Splunk Success Framework today, and please let us know what you think! What Else? We published several new articles and made updates to existing content throughout January. We’re also on the cusp of announcing some exciting new updates to our Use Case Explorers, which we’ll be blogging about next month. Our new articles you might be interested to see include: Sampling data with Ingest Actions for data reduction Knowing your financial services customer Troubleshooting database performance Troubleshooting a service latency issue related to a database query We hope you’ve found this update helpful. Thanks for reading! Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re focusing on a swathe of new articles written by fantastic Splunk partners. Our partners have a wealth of expertise in supporting use case implementation and delivering success to Splunk users, so we’re proud to have recently launched several new articles that allow you to use their knowledge for your benefit.   Articles From Our Partners Splunk’s partners are true experts in working with Splunk, so we’re excited to share these new articles with you. The insights and knowledge that our partners share through Lantern comes from valuable real-world experience working directly with customers like you. The topics our partners write about all contain actionable tips and useful best practices that you can apply to your own environment, helping you easily improve the way you work with Splunk.  Identifying Lantern articles written by partners is easy - you’ll see the name of the partner who wrote the article at the top of the article, just underneath the article title - you can see this in the example image below. The partner’s name displayed here is a link that you can click to see everything else they’ve written in Lantern. You’ll also find more information about each partner at the end of each article. Let’s dive in and take a look at the new partner-written articles we’ve published over the past month. If you’re looking to improve your data onboarding to make your Splunk deployment more efficient and to save money with workload pricing, check out Configuring new source types. This article shares ten key configurations that you need to be aware of when setting up a new source type, helping save the Splunk platform work when parsing events and sending data to indexers. Getting Okta data into the Splunk platform and Enabling Okta single sign-on in the Splunk platform are must-reads if you’re interested in working with Okta. The articles share how to enable single sign-on, ingest Okta data, and report and audit on Okta with the Splunk platform, with step-by-step processes you can follow to achieve this. On the topic of cloud migration, Selecting the best cloud migration approach explains some of the pros and cons of the different approaches available to customers when migrating to the cloud - whether you’re looking to start fresh in Splunk Cloud Platform without migrating historical data, running both environments before switching over, or performing a full migration of the on-premises deployment. This article is a great companion to our existing Splunk Cloud Platform Migration guidance. Writing better queries in Splunk Processing Language is a great article for anyone writing SPL regularly. The examples here help you learn how to write queries that minimize the number of trips to the indexers, minimize the amount of data coming back from the indexers, perform calculations on the smallest amount of data, and use non-streaming commands as late in the query as possible. These tips help you write effective queries that lead to quick and efficient search performance. Last but not least, Using the Splunk Enterprise Security assets and identities framework is useful for anyone looking to use the Assets and Identities Manager in Splunk Enterprise Security. It will help your analysts and incident responders get the information they need to work more effectively.   What Else? We published several other articles and made lots of updates to existing content throughout December. Our Data Descriptors are also undergoing a major overhaul, so if you haven’t looked there lately, take a look and see if there’s a new data source or data type you’d be interested to learn more about. Our new articles you might be interested to see include: Detecting insider threats Reducing platform management time with Splunk Assist Creating better custom applications with the Splunk UI toolkit Leveraging crime statistics to improve public safety We hope you’ve found this update helpful. Thanks for reading! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles which help you see everything that’s possible with data sources and data types in Splunk. This month we’re excited to share some great new video content on Splunk Lantern, produced by our friends at Splunk Education. These videos feature Splunk experts addressing hot topics requested by customers like you, with in-product demos so you can see exactly how to apply their guidance. As well as our new video content, this month we’ve also published lots of other helpful articles to share with you - read on to find out more. Brand New Education Videos Risk-based alerting is one of our most popular topics on Splunk Lantern, so we’re happy to add to our library with a new RBA video. Investigating interesting behavior patterns with risk-based alerting features RBA expert, Hayley Mills, demonstrating how to work with these alerts in Splunk Enterprise Security. If you’ve ever wondered how to more effectively demonstrate data trends and talk about insights from Splunk data with teams who don’t get hands-on with Splunk, Telling stories with your data using data visualizations is a great article for you. In this video, we show you how to use visualizations in the Splunk platform to create compelling charts, helping you to better tell compelling stories about what your Splunk deployment is showing you. If you’re interested in learning more about the Common Information Model, Normalizing values to a common field name with the Common Information Model (CIM) provides all the foundational learning you need to understand the CIM, and demonstrates to you how it works in action. Using Table Views in Splunk Enterprise helps you to tidy up issues with data quality. This video helps you to concatenate or rename fields, extract fields, or rework null values, all in a quick way without needing to run a lot of searches. We’ve also featured a bunch of videos this month that are all concerned with running faster, more efficient and more effective searches. Troubleshooting and investigating searches in Splunk Cloud Platform is an essential watch if you’re a Splunk Cloud Platform user who finds that sometimes, searches don’t run as expected - whether they’re running slowly, or knowledge objects in your environment aren’t behaving as expected. Chris from Splunk Education walks you through how to dig into the details of searches and identify areas to be adjusted. Using advanced macros in Splunk Enterprise teaches you how to create macros so you can reuse portions of your Splunk Search Processing Language (SPL) queries in other searches or independently. If you’re interested in creating searches with lower performance loads, Using summary indexing to accelerate searches is a great article for you to see how to create summaries of your event data - smaller segments of event data populated by background searches that only include the data needed to fulfill the search. Finally, Returning terms or indexed fields from event indexes with the Walklex command helps you to optimize or improve event segmentation within your deployment, with the aim to make searches faster and use less disk space. What Else? As well as our new video articles, we’ve also published a lot of new articles covering a multitude of other topic areas. Here are a few highlights: Our Splunk 9.0.2 FAQ is a popular read right now for anyone looking for the latest upgrade-related questions and answers. Getting Started with Splunk RUM has received a complete update and is a comprehensive resource for anyone wondering how to get proficient with RUM. As well as these, we’ve published a whole host of new use cases and product tips across Security and Observability. Here’s the full list: Improving incident notification processes Selecting the best cloud migration approach Receiving and storing queued time series data Monitoring Robotic Process Automation (RPA) systems Writing better queries in Splunk Processing Language Using modern methods of detecting financial crime Writing better searches with the Common Information Model Defining and detecting Personally Identifiable Information (PII) in log data Sending Splunk Observability events as Alert Actions We hope you’ve found this update helpful. Thanks for reading! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. The site also hosts Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk. This month we’re excited to announce the launch of a new live chat tool to help make it even easier for you to implement Lantern’s guidance! We’ve also got a fresh new batch of articles to share with you. Read on to find out more. Chat With us The Lantern team is proud to have a huge and growing library of actionable articles that you can pick up and apply straight away in your own environment. But there might be times that you have a question about how something is configured, or need some help from an expert to be sure that you’ve implemented things right.  That’s why we’re proud to say that we have partnered with Splunk’s OnDemand Services team on a live chat feature to help you solve problems in real-time. The chat system connects you instantly to one of our OnDemand experts, who can provide assistance on the specifics of our articles, as well as connect you to other ways you can get help from us. This initial trial of our chat feature is only available until Friday, November 18, so hop onto Lantern today and test it out with your most urgent Splunk implementation questions. Get started by interacting with the chat widget at the bottom-right-hand corner of all pages below our homepage.    We hope this extra layer of help gives you even more ways you can successfully implement our use cases, get our products working smoothly, and do even more with your data! New Security Articles This month has been a quieter month for Security-related articles, but we’re excited about our new additions, especially our new risk-based alerting article. Risk-based alerting is a consistently popular topic on Lantern, so we’re happy to bring this new article to our library. Investigating interesting behavior patterns with risk-based alerting includes a demo that helps you work with interesting events without adding extra noise to your already noisy alert environment. Risk-based alerting can help you improve your operational maturity, operationalize the MITRE ATT&CK framework, and reduce alert volume while increasing alert fidelity. If you’re a Splunk Enterprise Security user, Using the Splunk Enterprise Security assets and identities framework helps you learn to use the Splunk Enterprise Security Assets and Identities Manager to correlate asset and identity information with events to provide context and enrich data. New Observability Articles Adopting monitoring frameworks - LETS is a new article on monitoring frameworks. It introduces the 4 “Golden Signals” of Latency, Errors, Traffic, and Saturation (LETS), which provides a generic framework you can use to understand your software and infrastructure. It then shows you how this framework can also be applied to non-software-related scenarios. Minimizing alert storms in cloud and hybrid IT environments teaches you how to prevent alert storms and increase alert context with notifications from Splunk Observability Cloud detectors. Another article on Splunk Observability Cloud, Reducing time-to-resolution with interactive runbooks helps you build robust runbooks to reduce your organization's mean-time-to-resolution and make it less likely you'll get woken up in the middle of the night for escalations. Updates to the Use Case Explorer for Observability We’ve also published several new articles this month that are part of our popular Splunk Use Case Explorer for Observability. Monitoring AWS Lambda functions explains how to instrument Lambda functions to get visualizations, tagging, custom metrics, and detector notifications similar to what's in Splunk APM for microservice architectures.  Identifying application performance improvement opportunities shows you how to use Splunk Synthetic Monitoring to identify bugs, prioritize fixes, and optimize content that negatively impacts the performance of your application.  Finally, Optimizing application, service and memory usage with AlwaysOn Profiling for Splunk APM teaches you how AlwaysOn Profiling for Splunk APM can help you optimize application/service performance (CPU profiling) and memory usage optimization (memory profiling). What Else? This month, we’ve published some articles that include tips that aren’t security or observability-specific, as well as a new data article. Telling stories with your data using data visualizations includes a helpful video that introduces some ways you can use your data visualizations to tell stories - where your data points are used to express ideas, patterns, and insights to help understand what's happening. If you’re a Cloud user and ever find that there are occasions when searches don’t run as expected, Troubleshooting and investigating searches in Splunk Cloud Platform could be useful for you. It provides guidance on how to troubleshoot searches when this occurs, and provides tips so you can dig into the details of the search to understand what's happening. Lastly, if you’re interested in capturing, filtering, indexing, and analyzing streams of network event data, our new article Installing and configuring Splunk Stream helps you learn how to configure the app so you can start working with this data. We hope you’ve found this update helpful. Thanks for reading! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles which help you see everything that’s possible with data sources and data types in Splunk. Our library is constantly growing, and we’ve got lots of new articles to share with you! Here’s a full breakdown of everything we’ve published over September. New Getting Started Guides If you’re new to Splunk, you’ll want to check out our Getting Started guides for our Platform, Security, and Observability products. The curated paths there provide you with tips and links to all of the resources you’ll need to get Splunking like a pro.  We’ve made some updates to these guides over the past month. First, you’ll notice that we’ve just published a new guided learning path for Splunk Mobile. This walks you through how to set up the Splunk Mobile app, which gives you access to your dashboards, reports, and alerts while you are on the go.  We’ve also made some significant updates to our Getting Started path for SOAR, adding in extra videos, learning resources, and tips from experts to help your SOAR knowledge soar skywards. New Product Tips Articles We’ve published lots of product tips this month to help you achieve more with the Splunk products in your environment: Reducing low-value data ingestion to improve license usage introduces you to using the ingest actions feature in 9.0 to help you tier your data, sequester lower-value data, and selectively allocate data into cold storage. Creating an incident workflow in Splunk Enterprise Security shows you how to use the Splunk Enterprise Security workflow for investigations to help you complete investigations consistently, efficiently, and in a collaborative manner. Alerting on missing source types helps you learn how to monitor data ingestion and alert on missing source types in Splunk Enterprise. You can also learn how to alert on source type volume with machine learning to alert on cases where logs are present but in high or low volumes. Sending events and fields between Splunk platform and Splunk Observability Cloud provides you with a streamlined process that provides a record of when events occur, and makes them visible to developers and SREs in their own tools.   New Observability Use Cases It’s been a good month for Observability content and use cases, with several new use cases you can pick up and apply to your environment right away. Creating SLOs and tracking error budgets with SignalFlow walks you through how to create SLOs, alert on them, and create charting to show your error budget in alert minutes. If you’re a Snowflake user, Monitoring Snowflake database usage shows you how to build dashboards and detectors to help you answer common database usage questions, alert on them, and chart trends of important usage or performance metrics. On the Synthetics side, Running Synthetics browser tests teaches you how to create a synthetics browser test to assess how performance impacts user experience, and validate that sites and services perform as expected for the end user in the browser.   New Healthcare Security Articles Finally, if you handle security for a healthcare organization, we’ve also published a couple of articles that might be of special interest to you. Securing medical devices from cyberattacks helps you get insights into vulnerabilities, intrusion attempts, and general traffic on the medical devices on your network. Monitoring medical record numbers for anomalous access shows you how to monitor authorized and unauthorized access to patient information and identify risks associated with ePHI data breaches. What else? We’ve launched a new feedback widget on our site! This tab on the left-hand side allows you to tell us how articles are working for you, or where improvement is needed.    The survey is completely anonymous, so you won’t be able to receive a direct response to any comments you leave - however, you can always talk to us directly at Splunk User Groups Slack or Reddit. Please take the time to leave feedback on our articles so we can make sure our content is effective in helping you succeed with Splunk! We hope you’ve found this update helpful. Thanks for reading! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently. We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles which help you see everything that’s possible with data sources and data types in Splunk. Our library is constantly growing, and we’ve got a fresh new batch of articles to share with you! Here’s a full breakdown of everything we’ve published in the past month. New Data Articles Splunk Lantern’s Data Type and Data Source link you to all of the relevant apps and add-ons you’ll need to work with, as well as listing out all of the use cases we have for that data descriptor. These articles are great if your deployment is already ingesting a data source and want to see what other use cases you can accomplish with it, or if you’re curious about what you could gain through ingesting a new data source or type of data into your deployment. This month we’ve launched a new data source article for Syslog and a new in-depth guide that helps you set up a Windows-only computer network to run Splunk Connect for Syslog (SC4S) on a Windows server. Together with another article,s we published a few months ago, Understanding best practices for Splunk Connect for Syslog, these new articles provide you with a solid base of information that helps you implement S4CS smoothly and efficiently. AWS: Migrating inputs to Data Manager is another new article that shows you how to use Splunk’s Data Manager to improve your existing processes for onboarding AWS data, or help you onboard this data source easily if you’re looking to ingest it into your deployment for the first time. Check it out if this data source is one you’d like to explore further, and don’t forget to take a look at our other AWS data source articles too for more information about the use cases you can achieve. Getting started with the Splunk App for Ethereum is a new addition to our range of Blockchain articles, with this new guide walking you through how to set up and use the dashboards, macros, and searches in this app. 9.0.1 Updates and Product Learning One of our most popular new articles this month is our Splunk 9.0.1 FAQ, which covers the most commonly asked questions from Splunk's August 2022 security advisories that can be addressed by upgrading to Splunk Enterprise 9.0.1. While you should also check the Splunk Product Security page for the latest updates, this FAQ covers specific questions that Splunk Enterprise and Splunk Cloud Platform users might have. Another handy piece of product learning that’s just gone live is Preventing concurrency issues and skipped searches in Enterprise Security. Multiple, simultaneous correlation searches can cause search concurrency issues and skipped searches, so they should be scheduled differently, and this article provides you with a step-by-step guide so you can be sure you’re configuring your searches correctly to prevent this issue. New Security and Observability Articles Identifying high-value assets and data sources is a fresh addition to our Use Case Explorer for Security, which is designed to help you identify and implement prescriptive Security use cases that drive incremental business value. This article helps you prepare for attacks that specifically target your organization's high-value assets, preventing disruption to business continuity, reputational, or regulatory risk. On the Observability side, we’ve published two articles this month that help you work with Content Packs for Splunk IT Service Intelligence or IT Essentials Work. Gaining better visibility into your third-party APM solutions shows you how you can use the Content Pack for Third-party APM to gain insights across legacy APM vendors. Gaining better visibility into Microsoft Exchange explains how you can use the Content Pack for Microsoft Exchange to see everything going on across your Microsoft Exchange environment, so you can find and fix issues quickly. Finally, Monitoring AWS Fargate deployments powered by Graviton2 processors shows you how you can use Splunk software to track AWS Fargate clusters, SLA resource utilization, identify the root cause for task crashes, and create alerts and respond to them in real-time. What else? We’ve launched a new feedback widget on our site! This tab on the left-hand side allows you to tell us how articles are working for you, or where improvement is needed.    The survey is completely anonymous, so you won’t be able to receive a direct response to any comments you leave - however, you can always talk to us directly at Splunk User Groups Slack or Reddit. Please take the time to leave feedback on our articles so we can make sure our content is effective in helping you succeed with Splunk! Lastly, if you have been accessing Splunk Lantern articles using the knowledge bots of the Splunk Product Guidance app in the Splunk Cloud Platform, please note that those bots have been removed based on feedback. We apologize if you found those bots helpful, but don't worry - none of the great content has gone away. You can still search for help with SPL and data source onboarding at any time on lantern.splunk.com. We hope you’ve found this update helpful. Thanks for reading! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past month across Security, Observability, our new Use Case Explorers, and more. We’ve also got some updates on fresh Lantern functionality that you might find helpful to know. Read on to see what’s new! Use Case Explorer for Security updates In last month’s blog we announced the release of the Use Case Explorer for Security, and the Use Case Explorer for Observability - giving you a ‘color-by-numbers’ on how to grow and improve your Splunk usage throughout your journey to build a mature Security or Observability function. Over the past month we’ve made some updates to the Use Case Explorer for Security, and there’s more coming during August too. Using Splunkbase Add-ons and Apps with Splunk Enterprise Security - Ever wondered what the difference between Add-ons and Apps is, or do you need to learn how to work with Splunkbase to get them installed? This article helps answer those questions and more. Creating an Incident Response Plan (IRP) - This new article is part of the Automating incident response section of the Use Case Explorer. It lays out why you need an IRP and how you can create one to help guide your reaction to and remediation of different security threats. Using threat intelligence in Splunk Enterprise Security - Learn what threat intelligence data is and how to use threat intelligence data with Enterprise Security, helping you bolster your risk remediation and security program.  Observability articles We’ve published several new articles throughout July that focus on the capabilities of content packs you can use with IT Service Intelligence (ITSI). You’ll learn what’s included within each content pack, with a breakdown of all of the dashboards, glass tables, services, and more that you get by default when you add each content pack. Dive into each article to find out more: Moving to observability with ITSI Adding Real User Monitoring (RUM) to your ITSI environment Gaining better visibility into ServiceNow instances in ITSI Synthetic Monitoring has also been a focus for us this month, and we’ve published several articles that help you achieve new use cases and better understand Synthetics functionality.  Establishing performance benchmarks through competitor comparison lays out the process you’ll follow in Splunk Synthetic Monitoring to benchmark SLAs for the performance of your website against competitors.  If you’re interested in running and understanding the results of Real Browser Checks in Splunk Synthetic Monitoring, Looking into a failed Real Browser Check (RBC) run will be helpful for you to identify whether a failed check is due to a real issue your users are experiencing or whether there is a problem within the check itself. You can then use Confirming why a Real Browser Check (RBC) step is failing to diagnose the issue further. Finally, we know that SAP environments are critical to many types of enterprise workloads, and we’re working to help Splunk users understand the varied ways they can implement effective SAP monitoring using Splunk. We’ve published a new SAP data source page that introduces you to the Apps and Add-ons you’ll need to help you configure and work with SAP data, and a new use case, Monitoring SAP instance service health, that shows you how you can use Splunk Service Intelligence for SAP Solutions to get real time visibility into your SAP stack.  What else? Did you know that you can access Lantern guidance while you’re using Splunk? Splunk Product Guidance (SPG) augments your Splunk Cloud deployment and allows you to search Lantern’s use case and data source articles, giving you timely guidance when you need it most - while you’re searching and working inside the Splunk Cloud Platform itself. We’ve recently released some enhancements that make SPG more user-friendly. You can now drag and drop the SPG widget to anywhere on your screen, and when the SPG bot is expanded, you can resize it to make it smaller or bigger. These quality-of-life improvements should make working with SPG a better experience, allowing you to move it out of the way when you don’t need it, and adjust its size to your preference while you’re using it. We hope you’ve found this update helpful. Thanks for reading! — Kaye Chapman, Customer Journey Content Curator for Splunk Lantern ... View more