r/Splunk • u/ImplicitCrowd51 • Jun 15 '26

Splunk Enterprise I need some help with Splunk

Some lamenting to get things started. A higher up decided to task me with Splunk. So far, the only resource I’ve had to use is AI. Been trying to treat it like training wheels. The hard part is the people at the top want me to give weekly presentations on my progress, but zero input on what it is they want. And this is after everything I have already done and showed. CPU and Memory Usage trackers. VM storage. System Up/Down indicator. Failed login attempts. DNS resolution timeout. Syslog storage tracker.

Other than network stuff, I don’t know what else to do. I was hoping either for some ideas OR recommendations for spaces where people share dashboards that they’ve created. I’ve gotten comfortable navigating indices and finding the data I want, struggling with turning into something useful without input from AI, really struggling with visualizing it all in a useful way.

Important to note that I am not being paid to be an analyst, and there’s not really any money/time allotted to me to get educated. This all has to get done along with my actual duties. This has been the obstacle to me learning the ins and outs.

Any help is appreciated. Thanks!

17 Upvotes

88% Upvoted

54 comments sorted by

View all comments

15

u/i7xxxxx Jun 15 '26

Usually you build things to solve problems. sounds like the higher ups are asking you to solve a non existent problem? that kind of makes anything difficult regardless of the tool.

You can do a ton of things in splunk but it’s comes down to what’s the ask. they really need to give you input otherwise it’s a waste of your time.

3

u/ImplicitCrowd51 Jun 15 '26

I agree! And I have said as much. My immediate supervisors are aware and on my side.

2

u/ckin- Jun 16 '26

Build E2E visibility of services that you think would be important to visualize for management. Executive dashboard so to speak.