Skip to content

Articles & field notes

SPL

Search Processing Language patterns, performance, and correctness.

CIM NormalizationSPL

Why Windows Authentication Events Have Missing CIM User Fields

Windows authentication events are arriving in Splunk. The raw logs contain account names. Yet authentication dashboards show missing users, and searches that depend on normalized identities return incomplete results.

Conilious Abosi · 5 min
Platform MigrationSPL

Common problems in a Splunk-to-Observe migration

Moving dashboards is the visible part of a migration. Preserving the meaning of the data, and the decisions people make with it, is the real work.

Conilious Abosi · 5 min