Posts

How to Create a Splunk KV Store State Table or Lookup in 10 Simple Steps

/in , , /by

As of Splunk 6.2, there is a Key-Value (KV) store baked into the Splunk Search Head. The Splunk KV store leverages MongoDB under the covers and among other things, can be leveraged for lookups and state tables. Better yet, unlike regular Splunk CSV lookups, you can actually update individual rows in the lookup without rebuilding the entire lookup – pretty cool! In this article, we will show you a quick way of how you can leverage the KV store as a lookup or state table. Read more

How to Secure and Harden Splunk Enterprise

/in /by

The following blog posting provides guidance on steps that can be taken to secure and harden Splunk environments. Many of the security feature essentially follow security best practices, while others would probably only be implemented if there was a business or regulatory need to do so. Read more

Splunk’s Application for Enterprise Security Comes of Age

/in , /by

Splunk’s recently announced version 3.0 of its popular Splunk Application for Enterprise Security has come of age, delivering powerful functionality with a slick user experience. Read more