The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare for this change. What’s changing? OpenSSL version 3 is a significant upgrade from version 1. OpenSSL 3 features a new versioning scheme, significantly improved security features, and a new "Provider" concept for managing different cryptographic algorithms. It is generally not backward compatible, meaning applications designed for OpenSSL 1 may need significant changes to work with version 3. The Splunk platform is upgrading to the latest version of OpenSSL 3 in a future release to improve our security posture continuously. Splunk customers’ environments will require a few changes before they can upgrade to the Splunk version with OpenSSL 3 - including, but not limited to, the following:  use TLS 1.2-ONLY include the X509v3 extension for your CA certificate all Splunk apps relying on OpenSSL 3 should be compatible with Python 3.9 and Node.js 20 or higher (if using those languages)  become FIPS-certified for FedRAMP or FISMA customers.  The following delves deeper into each of the criteria mentioned above for an upgrade. 1. Use TLS 1.2 Only With 9.4, Splunk Enterprise announced the deprecation of TLS 1.0 and 1.1. TLS 1.0 and 1.1 (and SSL 3.0 and lower) are outdated protocols that use weak and insecure ciphers (e.g., International Data Encryption Algorithm(IDEA), Data Encryption Standard(DES)) to establish secure connections. They were formally deprecated in RFC 8996 in March 2021. Additionally, the National Institute of Standards and Technology (NIST) formalized policy 800-52 in 2014, which requires US government agencies to adopt TLS 1.2 and deprecate the use of TLS 1.1 and before. Lastly, OpenSSL 3 deprecated the support for any older versions of TLS less than 1.2. Removing support for TLS 1.1, 1.0, and SSL3 will lay the foundation for Splunk and its customers to upgrade to TLS 1.3, another mandate for US PBST + EMEA customers.  Actions to take: Confirm that your Splunk environment is configured to use the TLS 1.2 protocol anywhere you can specify a TLS version. The key places to look for the value are server.conf, web.conf, outputs.conf, and inputs.conf. 2. Ensure CA certificates used in Splunk include the X509v3 extension OpenSSL3 requires that any CA certificate must include the X509v3 Basic Constraints extension with CA: TRUE. Customers should ensure that any certificate used as a CA certificate in Splunk contains this extension. Actions to take: Update or replace any CA certificate that does not include CA: TRUE in the X509v3 Basic Constraints extension 3. Make sure apps are compatible with OpenSSL 3, Python 3.9, and node.js 20 or higher All apps installed in your Splunk environment must be compatible with OpenSSL 3. This means that any configurations in these apps that specify a TLS version must specify TLS 1.2 only, and it also means that apps that directly depend on the OpenSSL library must be using it in a way that’s compatible with OpenSSL 3 (e.g., deprecated APIs and cipher suites should not be used). Apps relying on OpenSSL 3 should also be compatible with Python 3.9 and Node.js 20 or higher (if using those languages). While Splunk does not currently have an automated approach to identifying all of these apps, we advise you to make sure any development teams maintaining private apps you have built for your own internal use cases comply with this change. The best way to test app compatibility will be to use the Splunk Enterprise 10.0 Beta - you can sign up here. 4. Prep for FIPS-140-3 certifications Splunk maintains an active commitment to meeting the requirements of the FIPS 140 standard. Splunk Enterprise and Universal Forwarder currently use an embedded cryptographic FIPS 140-2 module (4165), which can be activated for the Linux and Windows operating systems. The FIPS 140-3 standard was introduced in September 2019 and supersedes FIPS 140-2. As of September 2021, the Cryptographic Module Validation Program (CMVP) no longer accepts new FIPS 140-2 modules for validation. All FIPS 140-2 modules can remain active until September 21, 2026, and then will be moved to the Historical List. This means that Splunk must obtain a FIPS 140-3 certification, which requires upgrading to OpenSSL 3. Learn more about the transition from FIPS 140-2 to 140-3 (NIST). Actions to take:  All FedRAMP(Hi/Mod) Splunk Cloud customers and FISMA Splunk Enterprise customers that require a CMVP-validated FIPS module for their crypto library should ensure they are on a supported version of Splunk. All active and supported versions of Splunk are FIPS-certified. Customers should also look and plan for future Splunk releases when we upgrade our FIPS certificate to FIPS-140-3. The operating system on which you run Splunk Enterprise should also run in FIPS mode. For e.g., RHEL 8.x and Ubuntu 20.04 are FIPS-140-2 compliant OSs, whereas RHEL 9.x and Ubuntu 22.04 just recently got FIPS-140-3 certified Any app running on Splunk that requires cryptographic operations should only use a FIPS-certified version of the crypto modules(e.g., OpenSSL, BoringCrypto, BouncyCastle, etc.). Using the FIPS-certified crypto module that already ships with Splunk is easiest. 5. How to plan ahead? Sign up for our Splunk Enterprise OpenSSL 3 Beta to ensure your Splunk environment and applications are compatible and prepare to upgrade. ... View more

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a comprehensive survey designed for our valued Splunk administrators and app developers. Your expertise and insights are incredibly important to us, and we want to hear directly from you about your challenges and needs as a Splunk user. This survey is an opportunity for you to share your feedback, which will influence the future of Splunk products and services. We’re reaching out to professionals across organizations of all sizes, aiming to understand the key priorities and pain points you tackle in your day-to-day work.  Why Participate? Your opinion matters! Help us understand how we can: Improve Splunk product features and capabilities. Tailor our solutions to better support your use cases and goals. Improve Splunk’s value to you and your organization. We will: Provide a $35 gift card of your choice for the first 500 survey respondents.  Anonymize, summarize, and aggregate all submitted information. We will NOT: Use your individual responses for any marketing purposes. Share your responses with recruiters, partners or vendors. Take the survey here! ... View more

The Notification Team is migrating our email service provider. As the rollout progresses, Splunk has enabled the new email service provider for Splunk Cloud IL2, FedRAMP Moderate, and Fedramp High customers which are driven by customer requests from Splunk Ideas. Background Customer-configured email-based alerting is a first-class workflow supported by Splunk. We know how vital alerting can be to our customers. We are pleased to announce that Splunk Cloud FedRAMP High customers are also able to send email notifications to themselves for critically configured email-based alerts from the stacks now. Please take a moment to review a summary of the changes being introduced. Summary of Changes The email notification will be available for 4 use cases below sendemail SPL command Saved search  Emails for backgrounded jobs  Emails for health reports of the stack Emails initiated from within Apps Features Description Customer Impact MAIL FROM The MAIL FROM value in the SMTP envelope of emails originating from Splunk Cloud stacks will be mail.splunkcloudfed.com. The From field in these emails will be set to alerts@splunkcloudfed.com No downtime is expected and no action is required.    If you need clarification on any existing network policies on your end, please contact Customer Support so we can work with you to help ensure that you continue receiving email-based alerts. Dynamic IP addresses for origin mail server The origin email server is expected to have a dynamic IP address range in the future  Email size Email size, including body/text/images/attachments, is up to 40MB.   ... View more

Hi everyone! Splunk Observability Cloud provides end-to-end visibility and insights into the performance of applications and infrastructure. Splunk offers a series of Observability Cloud education courses that help users and professionals learn how to monitor, troubleshoot, and optimize the performance of their IT environments using real-time observability tools. These courses cover everything from the basics of infrastructure monitoring to advanced application performance management (APM) and real-user monitoring. Check out some free courses here! Register here for Visualizing and Alerting in Splunk Observability Cloud, here for Fundamentals of Metrics Monitoring in Splunk Observability Cloud, here for Getting Data into Splunk Observability Cloud, and here for Intro to Splunk Observability Cloud! Post a comment if you have any questions! Splunk Community Team ... View more

Hello everyone! Splunk SOAR (Security Orchestration, Automation, and Response) is a powerful tool that enables security teams to automate incident response workflows. Splunk offers a range of SOAR (formerly Phantom) education courses designed to help users and security professionals fully leverage its capabilities, from basic automation to advanced playbook creation and incident management. Check out some free courses here!  Register here for Developing SOAR Playbooks, and here for Advanced SOAR Implementation! Feel free to post a comment if you have any questions. Splunk Community Team ... View more

Hey everyone! Splunk IT Service Intelligence (ITSI) is a premium solution that helps  monitor and manage IT operations and services by using advanced analytics and machine learning. For folks and teams looking to build expertise in Splunk ITSI, there are EDU courses that focus on the platform’s features, from basic service monitoring to advanced predictive analytics. Here is the EDU link for some free courses! Register here for Using Splunk IT Service Intelligence course, here for IT Essentials Learn Walkthrough, and here for Implementing Splunk IT Service Intelligence! Feel free to post a comment if you have any questions! Splunk Community Team ... View more

Hi everyone! Splunk offers a variety of Splunk Cloud Platform education (EDU) courses that are designed to help anyone master the platform, whether they're just starting or are experienced users. These courses cover everything from Cloud platform management to Advanced search techniques, and Data integration. Check out this EDU link for some free courses! Register here for Splunk Cloud Admin, here for Introduction to Dashboards, here for Dynamic Dashboard, and here for Scheduling Reports & Alerts. Post a comment if you have any questions! Splunk Community Team ... View more

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The goal of the SplunkTrust™ program is not to recognize users in the room who know the most about Splunk. Rather, the SplunkTrust program was created to acknowledge and recognize those who go above and beyond to help their fellow Splunk practitioners and who have truly helped shape this wonderful, vibrant community.  This is an honor that represents a recognition by peers that the person embodies the hallmarks of the program — being helpful, technical, knowledgeable, and readily available. And it comes with perks, too! SplunkTrust members receive the coveted Splunk Fez with membership pin, Splunk EDU credits, and a free pass to .conf24. Splunk inducts the cohort of SplunkTrust members annually at .conf, which will be happening June 11 - 14 in Las Vegas this year. We’ll be welcoming four new SplunkTrust members, and welcoming back 48 returning members from our previous SplunkTrust selection. And so, without further ado, we are so excited to announce our .conf24 SplunkTrust cohort: New 2024 SplunkTrust Members Chris Barrett Bryan Beaulieu Sekar Sundaram Trayton White Returning SplunkTrust Members Brett Adams Ryan Adler Gareth Anderson Michael Bentley Steven Bochniewicz Mika Borner Antony Bowesman Becky Burwell Suat Celikok Siddhartha Chakraborty Mary Cordova Aleem Cummins Giuseppe Cusello Johannes Effland Mhike Funderburk Sanjay Reddy Gaddam Björn Hansen Vatsal Jagani Chris Kaye Steve Koelpin Tom Kopchak Sebastian Kramp Mariusz Kruk Charles Kuykendall Yuan Liu Rich Mahlerwein Mark McCullough Nick Mealy Madison Moss Martin Müller Cary Petterborg James Sevener David Shpritz Diogo Silva Kyle Smith Ismo Soutamo Daniel Spavin Keara Spoor Balaji Thambisetty Matt Uebel Kamlesh Vaghela Dominique Vocat Duane Waddle Colby Williams Tom Wise Yutaka Yamada Srikanth Yarlagadda Chris Younger And a huge congrats (and thank you!) to our incredible honorary SplunkTrust members as well! The Honorary Trust is composed of Splunk employees who embody the same wonderful, pioneering spirit that we look for in all SplunkTrustees. New 2024 Honorary SplunkTrust Members James Hodgkinson Returning Honorary SplunkTrust Members Karandeep “Deep” Bains Camille Balli John Billings Ari Donio Dustin Eastman Rich Galloway Tedd Hellmann David Hourani Charlie Huggard Kate Lawrence-Gupta Harshil Marvania Caroline McGee Clara Merriman Nadine Miller Matthew Modestino Brian Osburn David Paper Chris Perkins Nate Plamondon Michael Simko Lou Stella Jesse Trucks David Twersky Russell Uman John "Okie" Welch Tom West Congratulations again to everyone, and we can’t wait to see you at .conf in June! The Splunk Community Team ... View more

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of the Splunk community that have shown consistent participation in at least one area of our community programs. The Splunk MVP program, a complement to our longstanding SplunkTrust program, is one way the community team is able to recognize and celebrate our star contributors. The Splunk community is built upon the efforts of its members and the contributions they make to help their peers find success. We are incredibly thankful for your contributions! How do I become a Splunk MVP? Do you love answering questions about Splunk SOAR in Splunk Answers? That’s one way! Driving fabulous engagement as a leader of your Splunk User Group? That’s another way! Rockin’ out the Slack contributions? Chances are, you’re already well on your way! Splunk MVP selection focuses on community contributions, prioritizing engagement and support, in whatever areas you might be most passionate about.  Introducing our 2024 cohort of Splunk MVPs: First and foremost, let us say, THANK YOU! Our programs are built around your knowledge of Splunk, domain expertise, and passion to help your peers find success. And without further ado, our 2024 MVPs are… Uday Agrawal Marc Andersen Pedro Borges Steve Baker Johnny Blizzard Mark Cooke Marius Cuanda Eric Favreau Andrew Gerber Alain Giammarinaro Suman Gajavelly Lakshmanan Ganesan Adam Gold Taruchit Goyal Martin Hettervik Jason Hotchkiss Dal Jeanis Aaron Johnsen Rohit Joshi Nancy Kafer Chandra Sekhar Kolla Mike Langhorst Magnus Lord Alex Lu Rakesh Luhar Jo Øverland Guilhem Marchard Andrew McManus Manjunath Meti Phil Meyerson Renjith Nair Deyan Petrov Michael Pitcher Chris Risley Jean-Philippe Rosse David Rutstein Ryan Plas Gregory Rivas Rafael Santos Nadine Shillingford Matt Snyder Paul Schultze Trevor Scroggins Raja Sha Meet Shah Ayush Sharma Young So Somesh Soni Adam Denham Smith George Starcher Brandon Sternfield Davin Studer Erling Teigen Edoardo Vicendone Michael Uschmann Congratulations once again to the 2024 cohort of Splunk MVPs, and we hope to see some of you at .conf in June! The Splunk Community Team ... View more

We're so glad you're here! The Splunk Community is place to connect, learn, give back, and have fun! It features Splunk enthusiasts from all kinds of backgrounds, working at just about every kind of organization, and working in a variety of roles and functions. If you're landed here, you belong here. And we welcome you! This space is home to several community programs and supported by both a team at Splunk and growing group of our community members, including the SplunkTrust. Please connect with any and all of us, and we've made it pretty easy to tell who's who by their Ranks and profiles.  Meet the Splunk Community Team! Meet the folks who make up our Community Team! If you ever have any questions, concerns, or just want someone to digitally high-five, we're here for you! Anam S, Community Manager (Splunk Answers) Renee W, Sr. Community Manager (SplunkTrust) Brian W, Sr. Community Technology Manager Gretchen F, Sr. Content Manager, Community (Blogs & Announcements) Kara D, Associate Community Manager (User Groups) Jenny B, Community Specialist (Slack) Looking for a spot to introduce yourself?  Drop us a comment below and let us know where you're joining us from!  To get started... Have a look around! You can navigate through our community and programs by using the main navigation, and you can learn a little more about specific programs and areas in this post. Review our Community Guidelines! These spell out some of our expectations and requirements of all community members. So be sure to take a few minutes to review them, and be sure to abide by them.  Ask questions! Splunk Answers is the place to ask questions, get answers, and find technical solutions, for any product in the Splunk portfolio. Join us on Slack! There, you'll have even more opportunities to ask questions, get answers, and connect with your fellow Splunk practitioners. Again, we're so glad you're here!  -- Splunk Community Team  ... View more

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk Community,  We are thrilled to announce an exciting new chapter in Splunk's history: we are joining forces and officially becoming part of Cisco. This is a major milestone for Splunk in our ongoing efforts to build a safer and more resilient digital world — and we couldn’t be more excited for what’s ahead. The combined company will bring the full power of network data together with market-leading security and observability solutions. Together, we will provide unparalleled visibility and insights across our customers’ entire digital footprint, enhancing your ability to protect your organization, reduce business risk, and accelerate innovation velocity. Cisco shares Splunk’s passion for building thriving communities, and together, we expect to have even greater learning and collaboration opportunities for you. What does this mean for you?  For the immediate future, nothing truly changes. You should not expect any disruption to your Splunk experience as a result of this acquisition. You can continue to enjoy all of the Splunk Community platforms, programs, and events you know and love. What truly excites us is the potential to amplify the spirit of the Splunk Community on a larger scale. We know that this community thrives on creativity, collaboration, and fun, and with Cisco's help, we look forward to creating even more opportunities for you to share your voices, connect with others, and make a real impact. Together with Cisco, Splunk will deliver: A complete security solution for threat prevention, detection, investigation, and response, utilizing network and endpoint traffic for unparalleled visibility. A comprehensive full-stack observability solution for delivering seamless and reliable digital experiences across multi-cloud and hybrid environments. An Al-powered platform that correlates business and technology data to unlock insights that accelerate innovation and build digital resilience. We’ve collaborated with Splunkers, users and customers to answer the most commonly heard questions. Visit our website for FAQs and more information about Splunk joining Cisco. If you are a Splunk customer and have additional questions, please reach out to your account manager.  We are incredibly excited about our future, and over the coming months, we will continue to keep you updated about exciting developments in this new chapter. We are thrilled to be on this journey with you and we are grateful for your continued trust in Splunk.  ~ The Splunk Community Team     ... View more