Skip to content

Articles & field notes

Splunk knowledge, shared as we grow.

Practical writing for Splunk engineers, security teams, and platform owners: onboarding, CIM, SPL, dashboards, Enterprise Security, and platform operations.

CIM NormalizationSPL

Why Windows Authentication Events Have Missing CIM User Fields

Windows authentication events are arriving in Splunk. The raw logs contain account names. Yet authentication dashboards show missing users, and searches that depend on normalized identities return incomplete results.

Conilious Abosi · 5 min
Platform MigrationSPL

Common problems in a Splunk-to-Observe migration

Moving dashboards is the visible part of a migration. Preserving the meaning of the data, and the decisions people make with it, is the real work.

Conilious Abosi · 5 min