The Splunk health check we run on every new environment
Twenty checks, in the order we do them, that surface most of what is wrong with a Splunk platform in the first day. Nothing exotic: the same things, every time.
Read articleFeaturedMETHODOLOGY
InsightsNotes from the
Notes from the
middle of the work.
Splunk and Cribl methodology, architecture and operations, written from the field. We publish when we have something useful to say, not on a schedule.
ARCHITECTURESeptember 2026
When to choose Splunk Cloud, and when to stay on-prem
The decision is rarely about features. It is about who carries the operational work, where the data may live, and how much of your current setup you are willing to give up.
Read articleCRIBLSeptember 2026
Cribl Edge or the Universal Forwarder? The trade-offs that matter
Both collect data from the host. Only one of them lets you decide what to do with it before it leaves. Which is the point, and also the risk.
Read articleSubscribe
New insights land in your inbox roughly once a month. No funnel, no nurture sequence, just the writing.