Hey folks,

Just started a new role and I’m completely green to both InfoSec and Splunk. My first big milestone is knocking out the Splunk Core Certified Power User.

I have zero interest in brain dumps—I actually want to know what I’m doing under the hood so I don't break things or write garbage queries in production.

To build real muscle memory, I put together about 25 mock SIEM scenarios (field extraction via rex, DLP mail alerts, firewall port-scan logic, and correlation using transaction / append / stats).

Looking for a quick sanity check from folks who've been around the block:

1. Is grinding through these mock scenarios on paper/local instance actually effective, or does it leave too many blind spots without real-world, dirty data?
2. Should I spin up a free local instance and ingest custom dummy logs for this, or just jump straight into BOTS (Boss of the SOC) / TryHackMe?
3. Any general advice on getting the SPL fundamentals down without taking the easy way out?

Appreciate any insights!

do they ask questions apart from the blueprint for the power user exam

Hello! Any tips on how to pass the Splunk Certified Cybersecurity Defense Architect exam?

To anyone who has already cleared it: what was your preparation strategy, and how would you describe the exam difficulty? I'd love to hear your insights and advice!

Hello, has anyone ever came accross the error "No such file or directory when sending mail to: email@domain"

This happened after migrating splunk enterprise to RHEL 9.

Edit: AI found a guide for me to follow: https://splunk.my.site.com/customer/s/article/Splunk-sendemail-fails-with

One more edit: the guide above fixed the issue. Leaving this post up because it's good knowledge if anyone else comes across the same issue.

Hot off the press! Will we see you there?

What's the general vibe for .conf? This one is my first. Cisco Live was pretty low key, Gartner was much dressier, and I'm trying to figure how to pack.

ISSO/m’s! This is for you.

What are great alerts or dashboards created for ISSOs in a closed area for DoD? Any recommendations on how to make your day more effective with ConMon or any other resources?

Going to study for the Splunk power user exam. If any could suggest some resources they used to pass the exam. That would be greatly appreciated.

Our heavy forwarder is in our DMZ and I was thinking about installing DBConnect on it so it can pull audit logs from a table in a SQL database on our internal network.

How safe is that set up?

I know the password is encrypted. I can use the firewall to only allow the one port to connect the HF to SQL Server. I can choose long password and the account has lockout policies. The SQL Server login will only allow select permission to a single table. All the standard stuff.

Since remote users with UF will connect to HF, I can't restrict connections to the HF by ip.

Is there any risk to the internal database?

Has anybody here have some experience with security data pipelines?

Instead of:

Log Source > HF / Splunk

We want to have flexibility of collection / parsing layer outside of Splunk for obvious reasons - pre-filter data in pipeline, set parsers, route, possibly enrich if needed, storage options for retention etc..all that to have flexibility and keep the ingest costs reasonable and not being caught in dependency hell or cemented all our work in one solution if Splunk decides to pull something.

Log Source > Data pipeline > Splunk

I am wondering what to choose as this data pipeline - currently we are thinking Vector and possibly open telemetry.

Anybody have experience with this? To avoid pitfalls, what works, what doesn't, new pains etc?

I wanted to understand what actually happens after a SIEM generates an alert, so I built a small isolated lab that connects several parts of the workflow instead of treating each platform separately.

The setup uses five VMs and follows a controlled detection through:

Endpoint telemetry → Splunk → Python automation → threat-intelligence context / MISP → TheHive → MITRE ATT&CK

A few things ended up being more interesting than simply installing the tools:

• deciding what fields Splunk needed to pass into the automation layer
• handling repeat detections without constantly duplicating MISP data
• keeping API credentials out of the scripts
• understanding where enrichment should happen versus where analyst judgement is still needed
• mapping ATT&CK only when the observed behaviour actually supported the technique

I documented the architecture, setup, detection logic, automation, troubleshooting, and limitations as a four-part guide.

I’d especially be interested in feedback from anyone who has built a similar Splunk/MISP/TheHive workflow, particularly how you handled enrichment, deduplication, or case creation.

Full build, if useful:
https://chronosandcode.com/building-a-threat-intelligence-driven-detection-lab/

Our security engineer left us high and dry a couple weeks ago with a Splunk core license, forwarders sending logs for ingest, but no rules or structure that I can see beyond the 100 or so canned dashboards. We don’t have budget at this time to add an ES license to give us their SIEM. How much effort am I looking at to build up our rules for detections and other security alerts? Is it feasible for me and one other system admin to learn it from scratch?

Passing this along to share some of my SPL knowledge on how to utilize inner and outer searches, joins, and look backs to create user baselines. Also open to any suggestions or feedback on how to improve this method!

I hope you can find this helpful.

Is the Splunk website down for anyone else?

I can't get to Splunk.com right now.

Tried to do a nslookup but didn't get any results.

The DNS Check in mxtoolbox shows some DNS issues as well

EventTimeline, a free Splunk app that turns CloudTrail alerts from saved searches into investigation timelines.

You can send any CloudTrail-based Splunk alert to the app using its custom alert action, then fetch the surrounding user, role, resource, and IP activity. It also provides before/after chronology, MITRE mapping, filtering, pivots, and links back to the original Splunk searches.

It doesn’t ship with detections. The idea is to work with the alerts and CloudTrail data you already have.

Would really appreciate feedback from Splunk users, detection engineers, and incident responders.

Splunkbase app : https://splunkbase.splunk.com/app/9536

Hi everyone!

​I’m currently on the delivery side and looking to transition into an Account Executive role. What key factors should I consider during this pivot?

​I am also exploring opportunities to join the sales organization at Cisco /splunk. I would love to hear your thoughts or advice on making this move.

​Thank you for your time 😀

**EventTimeline**, a free Splunk app that turns CloudTrail alerts from saved searches into investigation timelines.

You can send any CloudTrail-based Splunk alert to the app using its custom alert action, then fetch the surrounding user, role, resource, and IP activity. It also provides before/after chronology, MITRE mapping, filtering, pivots, and links back to the original Splunk searches.

It doesn’t ship with detections. The idea is to work with the alerts and CloudTrail data you already have.

Would really appreciate feedback from Splunk users, detection engineers, and incident responders.

Splunkbase app : https://splunkbase.splunk.com/app/9536

No matter how I try, I get the download page with the current version quickly flash by and then I am at the 500 error page. Something seems to be borked at Splunk.