Unlock Use Cases for the Splunk Platform with our New Use Case Explorer (2024)

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data insights, key use cases, and tips on managing Splunk more efficiently.

We also host Getting Started Guides for a range of Splunk products, a library of Product Tips, and Data Descriptor articles that help you see everything that’s possible with data sources and data types in Splunk.

This month we’re excited to announce that the Use Case Explorer for the Splunk Platform has arrived! This new tool is designed to inspire as you develop new use cases using either Splunk Enterprise or Splunk Cloud Platform. We’ve also published a ton of new content covering a huge range of products, use cases, and industries! If you want to jump straight to our new articles, scroll to the bottom to read more.

Whether you're a seasoned Splunk user or just getting started, the Use Case Explorer for the Splunk Platform is a great tool to help you implement new use cases using either Splunk Enterprise or Splunk Cloud Platform.

It contains use cases that have been developed for five key industries - Financial Services, Healthcare, Retail, Technology Communications and Media, and Public Sector. Each of these industries operates in unique environments, with distinct challenges, so our use cases are carefully-tailored to fit these needs. Financial services, for example, holds a number of use cases to help customers detect fraud via ATMs, credit cards, and wire transfers. Healthcare contains guidance on maintaining HIPAA compliance. Or if you're looking to get inspired by a public sector use case, check out how NASA's ISS uses the Splunk platform to monitor metrics in its unique physical spaces.

But wait, there's more! The Use Case Explorer also contains a plethora of use cases designed to help you achieve your Security and IT Modernization goals - even if you're not using Splunk's premium Security and Observability products. (If you are using these products, you can check out the guidance for them within the Use Case Explorer for Security and Use Case Explorer for Observability.)

Like every use case in Lantern, every article comes with actionable, step-by-step guidance that you can follow to implement new use cases right away in your own environment.

Head on over to the Use Case Explorer for the Splunk Platform now and see for yourself. Happy exploring!

Team Lantern, along with experts from all across Splunk, have been working their tails off this month to publish a heap of new articles for you to explore. We're talking use cases galore and a huge range of tips that will make your head spin (in a good way, we promise!) Here are a few to start with:

Our Use Case Explorer for Security has undergone a number of new updates, with new Adoption Maturity guides to help you prepare for, implement, and measure a number of critical security outcomes. See the new guides here:

Threat intelligence
Risk-based alerting
Automation and orchestration
Cyber frameworks

If you’re interested in learning about using MITRE ATT&CK with Splunk Enterprise Security, check out another new Use Case Explorer for Security article on . It contains SPL queries you can run to assess your coverage, and step-by-steps you can follow to quickly expand it.

We’ve also made a few updates to the Use Case Explorer for Observability. Identifying DNS reliability and latency issues and Monitoring availability and performance in non-public applications are two new articles that help Splunk Infrastructure Monitoring users investigating Kubernetes network issues, and Splunk Synthetic Monitoring users who want to improve digital experience.

We’re excited to have launched a new Getting Started Guide: Getting Started Guide for Log Observer Connect. Log Observer Connect is an integration that allows logs on Splunk Enterprise or Splunk Cloud Platform to be queried and associated with Related Content in Splunk Observability Cloud. This guide shows you how to get it set up, from ingesting logs to verifying success.

Finally, Lantern is a home for FAQs relating to Splunk Enterprise upgrades, and we’ve released a Splunk 9.0.4 FAQ that addresses all the main questions you’ll have about updating to this version.

Those are just a few highlights of what’s been published on Lantern this month. Here’s everything else that we haven’t mentioned yet:

Building a data-driven law enforcement strategy
Identifying DNS reliability and latency issues
Detecting malicious activities with Sigma rules
Setting data retention rules in Splunk Cloud Platform
Securing infrastructure-as-code with Zscaler Posture Control
Data source: JupiterOne
Optimizing and automating SecOps with JupiterOne
Leveraging critical vulnerability insights for effective incident response
Setting up deployment server apps for the enterprise environment

We hope you’ve found this update helpful. Thanks for reading!

Kaye Chapman, Customer Journey Content Curator for Splunk Lantern

Unlock Use Cases for the Splunk Platform with our New Use Case Explorer (2024)

FAQs

Where can I find Splunk use cases? ›

To access the use cases in Splunk Enterprise Security click Configure > Content > Use Case Library. A great way to begin is by enabling a few correlation searches and adjusting them to fit your specific environment. Other places you can find ideas for use cases include: Splunk ES Content Update app.

What is the use case in Splunk? ›

Splunk's Use Case Explorer for Security is designed to help organizations become increasingly resilient as they expand into new cases: Security monitoring, incident management and compliance. Enhanced alerting with threat intelligence and risk-based alerting.

See Details ›

How do I open a support case with Splunk? ›

Go to Splunk.com > Support > Support Portal. The case creation form is broken down into areas pages to narrow the focus on certain questions.

Find Out More ›

What is the Splunk tool used for? ›

Splunk technology is used for business and web analytics, application management, compliance, and security. It correlates, captures, and indexes real-time data, from which it creates alerts, dashboards, graphs, reports, and visualizations.

Get More Info ›

Where is Splunk database located? ›

Each index occupies a set of directories on the disk. By default, these directories live in $SPLUNK_DB , which, by default, is located in $SPLUNK_HOME/var/lib/splunk .

Show Me More ›

Where is Splunk directory? ›

The location of the default directory in a Splunk Enterprise installation is $SPLUNK_HOME/etc/system/default . You should never change a configuration file that's located in the $SPLUNK_HOME/etc/system/default directory.

View Details ›

What is use of use cases? ›

A use case is a description of the ways in which a user interacts with a system or product. A use case may establish the success scenarios, the failure scenarios, and any critical variations or exceptions. A use case can be written or made visual with the help of a use case model tool.

Explore More ›

Why are use cases needed? ›

Use cases provide a proven method to capture and explain the requirements of a system in a concise and easily understood format.

Keep Reading ›

How do I unlock my Splunk account? ›

Unlock a user account in Splunk Web

In Splunk Web, select Settings > Users.
In the Users page, check the Status column to locate the user that is locked.
In the Action column for that user, select Unlock. The user can log in immediately with the correct credentials.

Get More Info ›

How do I check my Splunk permissions? ›

Go to the Roles tab on the Splunk Cloud Console page and click the New role button. Enter the name for this role. Search for permissions by application, service, resource, or operation. Certain permissions have required dependencies on other permissions.

Find Out More ›

How do I access Splunk? ›

Splunk Web runs by default on port 8000 of the host on which it is installed. If you use Splunk Enterprise on your local machine, the URL to access Splunk Web is http://localhost:8000 .

See Details ›

Why do people use Splunk? ›

Splunk gives organizations the confidence they need to quickly change course while minimizing business risk. With comprehensive visibility, teams can better understand interdependencies and the downstream impact of changes in their environments.

What does Splunk stand for? ›

What does Splunk mean? Spelunking is the hobby of exploring caves and mines. Splunking, then, is the exploration of information caves and the mining of data. Splunk helps you explore things that aren't easy to get to otherwise, like log data and messages and machine data.

Read On ›

Is Splunk easy to learn? ›

While you can grasp the basics in a matter of weeks, becoming a proficient Splunk user or administrator may take several months to a year. Remember that learning is an ongoing journey, and continuous practice and engagement with the Splunk community will contribute to your success.

Tell Me More ›

Where are Splunk scripts located? ›

All scripts must be located in a Splunk bin directory, either in $SPLUNK_HOME/bin/scripts or an appropriate bin directory within a Splunk app, such as $SPLUNK_HOME/etc/apps/search/bin ...

Discover More ›

Where can I find Splunk logs? ›

Splunk's internal logs are in $SPLUNK_HOME/var/log/splunk.

Explore More ›

Where are Splunk reports stored? ›

alerts and reports are stored in the savedsearches. conf file, that you can find in the "local" (also in default, but usually they are in local) folder of each app or system.

Find Out More ›

Where does Splunk data get stored? ›

The events are stored in in the splunk indexers in indexes in a timestamp order. By default the retention size per index is 500GB and the time retention is 6 years. It can be changed of course depending of your needs and of your storage. If you are looking for logs for application errors (splunkd.

Tell Me More ›