Splunk Community Secret Santa Gift Exchange!

Data Tree(Hi all! I’m posting this on behalf of one of our community members, Skip (aka f8al in our user groups chat), who is organizing the exchange. -rachel)

Get your holiday spirit on!

Do you like spreading holiday cheer? Of course you do!  Do you like seeing your splunky friends happier than Buttercup with a fresh apple? Who doesn’t?
If you answered yes to these questions then come on down and sign up for the 1st annual Splunk Usergroups Holiday gift exchange!
Elfster is a fun platform for doing this and keeps your information private and only shares it with the person who got your name, and even then, theres no obligation to use your …
» Continue reading

We proudly announce: the 2015-2016 SplunkTrust Membership!

Whew! Now that we’re back from .conf and the dust from Megacup’s hooves has settled, I’m proud and pleased to announce the inaugural membership of the SplunkTrust!

We created the SplunkTrust Community MVP program to recognize our community’s top contributors, and to involve them in planning and policy decisions as our community grows. These community members have shown the very highest level of commitment to helping others succeed with Splunk, and are the first year’s SplunkTrust member roster:



  • Aleem Cummins
  • Bernardo Macias
  • Camille Balli
  • Charlie Huggard
  • Chris Kurtz
  • David Shpritz
  • Duane Waddle
  • George Starcher
  • Gregg Woodcock
  • Jacob Wilkins
  • Kate Lawrence-Gupta
  • Kyle Smith
  • Martin Müller
  • Mason Morales
  • Michael Uschmann
  • Mark Runals
  • Mike Langhorst
  • Nick Mealy
  • Rich Mahlerwein
  • Sherman Smith
» Continue reading

Meet the 2015 Splunk Answers karma contest winners!

Congratulations are in order for Splunk Answers users Gregg Woodcock and Somesh Soni, this year’s winners of a free pass each to the 2015 Splunk Worldwide User’s Conference in Las Vegas!  Gregg won the July pass*, and Somesh won the August pass.

Every summer, we have a series of contests on Splunk Answers to award free passes to .conf. If you get the most karma points (awarded on the site for answering Splunk questions and helping other users) for a given contest month, you win!

If you’re coming to .conf this year, make sure to find Gregg and Somesh and shake their hands! Community rockstars like these are what make Splunk great. I’m grateful to be able to recognize and …

» Continue reading

Announcing the SplunkTrust Community MVP Program!

The meaning of the Splunk fez we know and love is about to come into sharper focus–splunktrust
–as the symbol for our new Community MVP program, the SplunkTrust.

The Splunk user community is one of the strongest, best communities in the world. We’re excited to be able to recognize our community leaders formally, thank them for their passion and service to other users, and to give them opportunities to learn about our roadmap and share product and process feedback with us.

What makes someone a SplunkTrust member?

SplunkTrust membership is open to Splunk customers and partners, and is renewed yearly. You can apply yourself, or nominate someone else. You do not have to be a ‘paying’ customer–your community contributions are what matter here. If you are nominated, …

» Continue reading

That happened: episode 42 (#splunk, the universe, and everything)

This week in “That happened: notes from #splunk”, a blog about the goings-on in the Splunk IRC channel:

There are really only 300 people on the internet

…and #splunk is 200 of them:

<RichardRa> Is it possible to timechart multiple fields per other field? More specifically, I am wanting to show a timechart of freespace by device by host. Using one of the Linux-TAs, my pseudo-search would look like: index=os_nix sourcetype=df | timechart span=5m max(UsePct) BY MountedOn BY host
<duckfez> RichardRa: by device by host or by the (device,host) tuple?
<Ayn> RichardRa: trying to think about what that would look like
<RichardRa> So, my goal would be a line for each device …

» Continue reading

.conf 2014: The Community Report

Whew! Welcome back from .conf, everyone. I know it’s been two weeks since we all hung out together in the Community Lounge, but it still feels like we only just left the MGM yesterday…

All for you: the Community Lounge

This year at .conf, we created an intentional space for our amazing user community: you. You folks are the reason we’re here, and we wanted you to have a cool place to meet other Splunk users, talk about the stuff that matters to you, and get a little fun in at the same time.

The Answers Desk

The Splunk Answers Desk was, as always, hugely popular. Our staff of lab-coated (and sometimes be-fezzed) Support and Sustaining Engineering specialists were kept busy helping …

» Continue reading

Get your Community on at .conf2014!

Community is HUGE at Splunk, and we’re doing it up big at this year’s .conf with our own gigantic Community Lounge. Here’s a sampling of what’s in the works:

Masters of IRC panel discussion

Wednesday, Oct 8th 11am-12noon on the Community Stage

Join us for an informal panel discussion with 6-7 of our most knowledgeable, longtime customers from the #splunk IRC channel. They will be taking your questions and sharing best practices and stories from their long years of experience deploying and maintaining Splunk at scale. Bring your questions! Whisky optional, but recommended :).

Learn how to start your own Splunk User Group (and meet other people who do, too)

Wednesday, Oct 8th, 12:15pm – 12:45pm on the Community

» Continue reading

Give the gift of karma…at .conf!

Are you a Splunk Answers user? Are you attending Splunk’s 5th Worldwide User Conference next week in Las Vegas? Do you want a way to show your appreciation for other .conf attendees, presenters, vendors, your Splunk University instructors (besides buying them a drink*)?

Introducing SplunKarma, the mobile karma dispenser!

Starting on Saturday, October 4th (the first day of Splunk University), you can visit http://answers.splunk.com/karma from your mobile device and log in with your Splunk Answers credentials. You’ll be given a cache of karma points to use to reward the members of the Splunk Community around you at .conf. All you need to do is find out what their Splunk Answers userID is.

If you’re speaking at .conf, tell your session audience your Splunk Answers …

» Continue reading

Splunk Answers is now migrated!

Splunk Answers has just been migrated to a new platform!  Read more about the process and goals.

What to expect

You won’t see much in the way of UI changes, but the site underneath will be more stable and more flexible.  You should experience faster loading times, more responsive controls, and very importantly, an improved search experience. We will now also have access to new and improved spam blocking features, a much-needed improvement.

The goal of the initial migration is to maintain feature parity with the existing Splunk Answers site. This will help us make sure we don’t break anything you’ve come to rely on. Over time, we will be able to launch new features and improved functionality.

Update: …

» Continue reading

Splunk Answers migration coming up on Sept 12th!


9/13 12:30pm Pacific: Still working out final issues with userID mappings. Sorry for the delay!


Home to more than 35,000 questions and more than 43,000 answers as well as a thriving community of your fellow Splunk users, Splunk Answers will be getting an update soon! Here’s what to expect:

What will happen during the migration?

During the migration process, we will put the existing production site into a read-only mode so we can get the most up-to-date copy of the Answers database to use on the new site. This will start at around 8pm Pacific, which our own Splunk instance tells us is when usage of the site begins to taper off significantly for the weekend. During this time, you will be able to …

» Continue reading