Administrators Anonymous: Splunk Best Practices and Useful Tricks I Learned the Hard Way

"Throughout my journey as Splunk admin, I've experienced a few stumbling blocks along the way (okay, maybe more than just a 'few'). Having seen some of these same mistakes being made by others, I want to show you how you can avoid them. In this session, you will learn about some of the common pitfalls and how to detect them, best practices and how to leverage them, and other useful knowledge from my experiences as a Splunk architect, admin, and instructor that you can take away."

From .conf19, session FNC1549

Special thanks and credit to Tom Kopchak, Hurricane Labs