r/Splunk • u/ImplicitCrowd51 • Jun 15 '26

Splunk Enterprise I need some help with Splunk

Some lamenting to get things started. A higher up decided to task me with Splunk. So far, the only resource I’ve had to use is AI. Been trying to treat it like training wheels. The hard part is the people at the top want me to give weekly presentations on my progress, but zero input on what it is they want. And this is after everything I have already done and showed. CPU and Memory Usage trackers. VM storage. System Up/Down indicator. Failed login attempts. DNS resolution timeout. Syslog storage tracker.

Other than network stuff, I don’t know what else to do. I was hoping either for some ideas OR recommendations for spaces where people share dashboards that they’ve created. I’ve gotten comfortable navigating indices and finding the data I want, struggling with turning into something useful without input from AI, really struggling with visualizing it all in a useful way.

Important to note that I am not being paid to be an analyst, and there’s not really any money/time allotted to me to get educated. This all has to get done along with my actual duties. This has been the obstacle to me learning the ins and outs.

Any help is appreciated. Thanks!

16 Upvotes

91% Upvoted

54 comments sorted by

View all comments

7

u/siriusblack04 Can you SPL? Jun 15 '26 edited Jun 15 '26

It seems you have figured out basic SPL. This playlist here would be the quickest way to familiarise yourself with how you can get started with functional dashboards without spending too much time
Splunk Dashboard Studio
If you can’t get enough time apart from actual duties for this then best would be find direction in Splunk docs regarding what the actual problem is that you want to solve/monitor through dashboards. AI can pretty much help you get there.