David Bombal #553: AVOID the Grep Trap: Why Splunk is the Future of Networks
Mar 3, 2026
Intro to Splunk as a powerful replacement for manual grep-style searches. A primer on SPL and the new SPL2 search styles. Live demos analyzing web and Linux logs, field extraction, and building dashboards. Unusual real-world uses like train telemetry and even toilet monitoring. A showcase of AI Canvas for natural-language troubleshooting and alert-driven workflows.
AI Snips
Chapters
Transcript
Episode notes
Use Indexes To Control Retention And Access
- Ingest data into indexed buckets and set retention per index to manage volume and access control.
- James notes top customers ingest 100+ TB per day and use indexes to rotate high-volume data faster.
Send Raw Logs With A Universal Forwarder
- Deploy the Splunk Universal Forwarder to tail logs and capture timestamp, host, source type, and source on ingestion.
- Splunk retains raw events and performs schema-on-the-fly, extracting key-value pairs or using regex at search time.
Splunk Handles Logs Metrics Traces And IoT
- Splunk ingests not just logs but metrics, traces, events, and IoT telemetry, enabling cross-domain stitching for user journeys.
- James gives examples from fighter jets to trains and industrial PLCs via Kepware integrations.