By Tom Casey October 25, 2023
Splunk Platform introduces new data management capabilities that enable faster and more cost-effective root cause analysis and incident resolution of customer-facing issues, regardless of whether the data resides in Splunk or Amazon S3, with information at the fingertips of both leaders and practitioners.
Today, our customers turn to Splunk when they face lack of visibility across data silos and increasingly complex technical landscapes. Limited control and choice over data management can lead to customer experience challenges and higher costs. I am excited to shine a light on several recent Splunk Platform innovations enabling customers to build digital resilience through expanded access to decentralized data, enabling better understanding of customer-facing issues, regardless of whether the data sits in Splunk or cost effective Amazon S3 storage, facilitating compliance with data sovereignty requirements.
Introducing General Availability of Federated Search for Amazon S3 from Splunk Cloud Platform
Enterprises rely heavily on cloud storage solutions as a destination for their high volume-low value data given its cost-effectiveness, scalability and manageability. However, one of the biggest concerns when using cloud storage solutions is data movement, since it can introduce latency and egress costs. For improved data access to and searchability of this data, without the need to move data around, Splunk introduces Federated Search for Amazon S3 to search data from Amazon S3 buckets directly from Splunk Cloud Platform without needing to ingest it. ITOps and SecOps Admins can connect their AWS account to Splunk and specify the desired S3 buckets that they want to read data from, and users can execute regular SPL searches against them and create dashboards, alerts and reports as they typically would, as well as correlate data between Amazon S3 and Splunk.
Enhancements to Edge Processor for Splunk Cloud Platform
Customers continue to struggle with not only high data volumes with a lot of noise and alert overload, but also with a variety of sources, data types, and formats that make it difficult to decipher event patterns, prioritize issues, or implement effective correlation. Edge Processor gives customers more flexibility and control over their data management with the ability to filter, mask, and route data before it leaves their network boundaries.
Enhancements to Edge Processor further equip Splunk Admins with data management capabilities that reduce or filter noisy alerts in an effort to accelerate search and investigation. The addition of syslog as an ingest protocol enables customers to apply Edge Processor to a primary data type needed for log analytics with optimized data fidelity, performance and scale.
Continued Delivery Against Splunk’s AI Vision
Detection, investigation, and response can be lengthy and complicated. Increased traffic during the holiday season can drive more cyber attacks and performance issues. Our customers need real AI-powered tools that help increase productivity of detection, alerting and response, and prevent issues before they negatively impact customer experience.
Splunk has domain-specific insights derived from real-world experience to help customers detect, investigate and respond faster. Splunk’s AI-powered offerings can help customers mine context-rich data to surface important events and signals. Human-in-the-loop AI provides situational awareness with intelligent event summarization and interpretation. With the help of AI, Splunk admins can operate Splunk Platform more easily and gain productivity with tasks such as writing SPL, detecting anomalies, automating playbooks and workflows, implementing data science tools, and more. Additionally, Splunk users can leverage generative AI with Splunk AI Assistant (preview) which can enable more users and faster SPL answers.
Splunk continuously delivers innovation across our unified security and observability platform to aid our customers’ digital resilience journeys. Innovation builds upon our data platform to solve complex security and observability use cases. Learn more about what is new across Splunk in our "Driving Digital Resilience to Deliver Exceptional Customer Experiences During High-Traffic Periods" blog.