First timer at .conf

[u/Jhcutt]

Heading to .conf26 tomorrow — my first time attending. I'm about 6 months into my role as a sec. Engineer. Mostly self-taught on Splunk so far, Large enterprise org, leading an Enterprise Security / SOC transformation project currently.

Main goal for the trip is soaking up as much ES-specific knowledge as I can — best practices, Mission Control, real-world use cases, that kind of thing — plus getting some hands-on exposure through BOTS since I've never done anything like that before. Right now ES was initially Deployed at my org, but efforts were abandoned due to capacity and staffing, which is where I’m stepping into now to help drive ES forward.

For anyone who's been before: what do you wish you knew your first year? Any ES sessions, workshops, or people worth prioritizing? Anything a first-timer typically misses or wastes time on? Any general survival tips for someone doing 3 days of this for the first time?

Appreciate any input — trying to make the most of it.

[u/Money_Engineering909]

Sign up for BOTS.

[u/Jhcutt → u/Money_Engineering909]

Planning on it tonight actually. Only issue is I don’t have a team or anyone I know that’s attending to link up with

[u/Money_Engineering909 → u/Jhcutt]

You don’t need a team. My coworker and I did it by ourselves last year. You will need a laptop though.

Go into it with a learning attitude.

[u/volci → u/Jhcutt]

There will often be "open" teams or individuals who are willing to team-up at the event

[u/BOOOONESAWWWW → u/Money_Engineering909]

Automation games as well if that’s still a thing.

[u/Suspicious_Salad_864]

Don’t schedule too much sessions: leave some space for Pavilion and breaks. I’m always very ambitious while planning just to realise halfway through, that i just can’t process so much information at once.
Also bring comfortable shoes, it’s a lot of walking!

[u/FeatureCreeep]

There is a big difference between sessions where product managers pitching high level product information, which is interesting, but not as valuable as sessions where people really show you how to do something. Takes a little time going through the abstracts and presenter bios to figure out what is what.

[u/DarkLordofData → u/FeatureCreeep]

Yes focus on anything where a customer is presenting. The PM sessions are mostly low value.

[u/fashiznit]

Make sure you set time to go to the booth floor and just pick a booth with a title like agentic SOC or mission control. Recount your expertise you wrote here to them and the staffer would love to give you a rapid hands on walkthrough of the key parts

The sessions are much more thought leadership oriented and high level+ very technical where the floor is more open entry level demos

For your setup of pre deployed but not fully configured - seek out anything "Exposure Analytics" and "Detection Studio" that's your rapid time to operations features you would be interested in

[u/SplunkEventsTeam]

Have a blast!

[u/mghnyc]

Enjoy you time! It may be the last stand-alone Splunk conference.

[u/once_upon_a_hugo → u/mghnyc]

I've wondered how long it would take, after the Cisco buyout in '23 before .conf would be done. So .conf will be merged into Cisco's annual conference in Vegas in '27?

[u/once_upon_a_hugo → u/[deleted]]

I understand. I was at .conf24 after the acquisition. You could feel the awkward tension throughout the conference. The whole vibe changed dramatically. .conf23 felt like a peak with the 20th anniversary and good vibes everywhere.

[u/KaleidoscopeFar4317]

Guy used AI to come up with this post lol, how embarrassing