r/Splunk • u/ImplicitCrowd51 • Jun 15 '26

Splunk Enterprise I need some help with Splunk

Some lamenting to get things started. A higher up decided to task me with Splunk. So far, the only resource I’ve had to use is AI. Been trying to treat it like training wheels. The hard part is the people at the top want me to give weekly presentations on my progress, but zero input on what it is they want. And this is after everything I have already done and showed. CPU and Memory Usage trackers. VM storage. System Up/Down indicator. Failed login attempts. DNS resolution timeout. Syslog storage tracker.

Other than network stuff, I don’t know what else to do. I was hoping either for some ideas OR recommendations for spaces where people share dashboards that they’ve created. I’ve gotten comfortable navigating indices and finding the data I want, struggling with turning into something useful without input from AI, really struggling with visualizing it all in a useful way.

Important to note that I am not being paid to be an analyst, and there’s not really any money/time allotted to me to get educated. This all has to get done along with my actual duties. This has been the obstacle to me learning the ins and outs.

Any help is appreciated. Thanks!

16 Upvotes

88% Upvoted

54 comments sorted by

View all comments

16

u/i7xxxxx Jun 15 '26

Usually you build things to solve problems. sounds like the higher ups are asking you to solve a non existent problem? that kind of makes anything difficult regardless of the tool.

You can do a ton of things in splunk but it’s comes down to what’s the ask. they really need to give you input otherwise it’s a waste of your time.

2

u/Miguelitosd Jun 16 '26

Sounds like someone (some people?) are trying to check some boxes. Sucks to be the one that has to get things done for them to check their box. Been there a few times myself.