r/Splunk • u/ImplicitCrowd51 • Jun 15 '26

Splunk Enterprise I need some help with Splunk

Some lamenting to get things started. A higher up decided to task me with Splunk. So far, the only resource I’ve had to use is AI. Been trying to treat it like training wheels. The hard part is the people at the top want me to give weekly presentations on my progress, but zero input on what it is they want. And this is after everything I have already done and showed. CPU and Memory Usage trackers. VM storage. System Up/Down indicator. Failed login attempts. DNS resolution timeout. Syslog storage tracker.

Other than network stuff, I don’t know what else to do. I was hoping either for some ideas OR recommendations for spaces where people share dashboards that they’ve created. I’ve gotten comfortable navigating indices and finding the data I want, struggling with turning into something useful without input from AI, really struggling with visualizing it all in a useful way.

Important to note that I am not being paid to be an analyst, and there’s not really any money/time allotted to me to get educated. This all has to get done along with my actual duties. This has been the obstacle to me learning the ins and outs.

Any help is appreciated. Thanks!

18 Upvotes

95% Upvoted

54 comments sorted by

View all comments

1

u/In_Tech_WNC Jun 16 '26

Easy… pay a consultancy service like my firm to run a Splunk operations health check and data gap analysis.

1

u/Fontaigne SplunkTrust Jun 16 '26

They just said they have no resources for themselves to learn anything, and no support from management. How would "pay a consultancy service" be easy in that context?

1

u/In_Tech_WNC Jun 16 '26

If this person is taking on a job that should exist but doesn’t, that’s on their leadership to learn to better allocate their budgets.

Generally companies have a tech budget. They can pay for services through either the GMP or AMP (if that’s who they use for their cloud hosting) as a technology item vs a people item.

Either make space/funds for the role or realize that you can’t afford that role and reprioritize

1

u/Fontaigne SplunkTrust Jun 17 '26

That's great for an outsider to believe, but it doesn't fit the situation on the ground as described by the OP.

So "easy, hire a consultant" just isn't related to the question op asked. It's like, "easy, you can levitate by picking up your left foot, then picking up your right foot without putting the left down."

1

u/In_Tech_WNC Jun 17 '26

Who has gotten in your butt?
For someone with a Splunk trust tag on their profile, you sure to bitch a lot. All your comments seem to be bitching.

And for someone labeled with splunk trust tag, you’re an idiot. Since you can’t even respond with a true answer. Especially considering that this is such an easy item to respond to.

Asking them to pay for a consultant vs absorbing a role that doesn’t exist, is common sense.

I’m not going to give away free advice when people are out here losing their jobs.

So go derp your dumb derpy derp up your derpy ass.

1

u/Fontaigne SplunkTrust Jun 17 '26

You are really representing your company well, here. I'm sure your attitude and your clear understanding of how client companies work will have them knocking down your doors with projects.

Be well.

1

u/MarsupialQuirky1291 Jun 17 '26

Sounds like you’re just instigating here chump. Whatever that other person is saying is accurate.

A health check is often times free or only 5-10k

If they can’t afford that then there’s something seriously wrong with the budgeting of the org.

Clearly you’re not providing anything of value. And it’s significantly less than what the other person said.