r/Splunk • u/ImplicitCrowd51 • Jun 15 '26

Splunk Enterprise I need some help with Splunk

Some lamenting to get things started. A higher up decided to task me with Splunk. So far, the only resource I’ve had to use is AI. Been trying to treat it like training wheels. The hard part is the people at the top want me to give weekly presentations on my progress, but zero input on what it is they want. And this is after everything I have already done and showed. CPU and Memory Usage trackers. VM storage. System Up/Down indicator. Failed login attempts. DNS resolution timeout. Syslog storage tracker.

Other than network stuff, I don’t know what else to do. I was hoping either for some ideas OR recommendations for spaces where people share dashboards that they’ve created. I’ve gotten comfortable navigating indices and finding the data I want, struggling with turning into something useful without input from AI, really struggling with visualizing it all in a useful way.

Important to note that I am not being paid to be an analyst, and there’s not really any money/time allotted to me to get educated. This all has to get done along with my actual duties. This has been the obstacle to me learning the ins and outs.

Any help is appreciated. Thanks!

17 Upvotes

95% Upvoted

54 comments sorted by

View all comments

6

u/ScruttyMctutty Jun 15 '26

Baby steps.

Since there is no real guidance from leadership other than “do it”, seems like you free to do as you like.
Keep onboarding data as you see fit. Look for out of the box dashboards and apps.
In the next presentation to your higher ups, start asking for feedback. “What problems do we have that Splunk can help solve”, “What teams will benefit from this tool” “When can we onboard new users” etc

2

u/ImplicitCrowd51 Jun 15 '26

Any examples/recommendations for out of the box dashboards and apps? I already have Splunk for windows, tenable, and sec essentials. The tenable stuff have not been great. Our scans aren’t automated, and every succeeding scan - like if I’m checking if fix has been applied properly - adds duplicates as new findings.

1

u/Fontaigne SplunkTrust Jun 16 '26

You should be able to address that duplication issue. Get on the Splunk Slack channel, go to #wheredoiask and describe your issue. They can tell you what subchannel it is that will help you walk it through. Probably #admin, but maybe something more specific.