Here are the slides for my .conf26 presentation: Also, make sure to read my original article, it contains lots of details and the dashboard-generating dashboards to help you: https://www.gabrielvasseur.com/post/shrink-your-windows-event-logs-license-costs-with-ingest-actions

Are you tracking changes in your Splunk deployment? Most people don't, unless they can justify having a custom (heavy!) process using...

Data models and especially their acceleration are often misunderstood by Splunk users. Yet they are absolutely critical, especially for...

Regular expressions are extremely useful. They are everywhere, including in Splunk. And they are useful to everyone, not just data...