Day 10 is here. Part 1 challenge First a quick summary of the challenge in case you're not logged on the advent of code or haven't reached day 10 yet. We are given a target light pattern we need to achieve, for instance [.##.], and a set of buttons, for instance (3) (1,3) (2) (2,3) (0,2) (0,1). [.##.] means first light off, second and third on, and fourth off. Buttons are used to toggle lights on and off. So button (3) would toggle the fourth light. Button (1,3) would toggle

Windows events are a large part of the volume of logs ingested in a lot of splunk deployments. Wouldn't be cool if we could shrink them so they don't eat up so much precious precious license? In this post I'll walk through how I rebuilt Windows Event Logs (WELs) into a compact, Splunk-friendly format, cuting size by up to 60% without breaking field extractions. Key takeaways With a few targeted ingest actions and props/transforms tweaks, you can shrink Windows logs dramatical

The key thing I did not appreciate when I wrote the previous version of this post is that the Risk data model is now fed from...

Since RBA is all about aggregating security events that are related to the same entity, Assets & Identities normalisation is crucial to...

On the 18th of September 2024 I gave a talk on this topic at the London Splunk User Group meetup. Ingest Actions are a simple feature of...

I have been nominated for a 2023 Splunkie Award and I am delighted to be a finalist for the Inventor Award! https://conf.splunk.com/the-s...