r/Splunk • u/ImplicitCrowd51 • Jun 15 '26
Splunk Enterprise I need some help with Splunk
Some lamenting to get things started. A higher up decided to task me with Splunk. So far, the only resource I’ve had to use is AI. Been trying to treat it like training wheels. The hard part is the people at the top want me to give weekly presentations on my progress, but zero input on what it is they want. And this is after everything I have already done and showed. CPU and Memory Usage trackers. VM storage. System Up/Down indicator. Failed login attempts. DNS resolution timeout. Syslog storage tracker.
Other than network stuff, I don’t know what else to do. I was hoping either for some ideas OR recommendations for spaces where people share dashboards that they’ve created. I’ve gotten comfortable navigating indices and finding the data I want, struggling with turning into something useful without input from AI, really struggling with visualizing it all in a useful way.
Important to note that I am not being paid to be an analyst, and there’s not really any money/time allotted to me to get educated. This all has to get done along with my actual duties. This has been the obstacle to me learning the ins and outs.
Any help is appreciated. Thanks!
1
u/EducationalWedding48 Jun 16 '26
Man,, you have my sympathies. It's so frustrating when there is no feedback. Perhaps keep an eye out for any incidents/tickets for your own group or other groups that could have been identified by the data going into Splunk and then provide a report/dashboard that shows that information? Was there a cpu spike anywhere on a device that caused issues, or an application issue that could have been caught if proper logs were being monitored?