18:42:07.113 idx-cluster-01 sourcetype=WinEventLog:Security EventCode=4624 action=success
18:42:07.208 ingest-proc pipeline=win_reduce in=1.00TB out=550GB fields_kept=100%
18:42:07.344 cribl-worker-2 route=edr_to_splunk format=csv saved=67%
18:42:07.512 es-notable rule="Brute Force Access" src=10.20.4.17 urgency=high
18:42:07.690 deployment-srv forwarders_connected=9987 sla=99.9%
18:42:07.950 prometheus job=adapter up=1 p95_latency=212ms
18:42:08.104 loki {app="p2p-flow"} |= "error" count=0
18:42:08.233 tempo trace=4bf92f3577b34da6 spans=38 duration=1.2s
18:42:08.377 alert name="Host not reporting" host=fw-edge-03 sent_to=ServiceNow
18:42:08.512 slack channel=#siem-alerts delivered=true
18:42:08.640 hf-02 sourcetype=fortigate_traffic routed=index:firewall
18:42:08.781 aws-lambda s3://audit-logs -> hec events=12408 status=ok
18:42:08.902 search-head | tstats count where index=* by sourcetype took=0.84s
18:42:09.015 ta-digicert-one input=audit_logs fetched=214 checkpoint=saved
18:42:09.170 grafana dashboard="P2P flow health" panels=12 state=healthy
18:42:09.322 edge-proc-01 node=onprem-a pipeline=fw_normalize dropped_fields=0
JH
Jigar Hirani
Splunk · Cribl · SIEM
Observability Engineer at Rojo Integrations
I run large Splunk environments end to end: onboarding and parsing data, building detections, dashboards and add-ons, and shaping pipelines so the platform keeps every field it needs and none of the noise.
- 10 TB+ingest a day
- −3 TBcut a day
- 2Splunkbase add-ons
Certifications
-
- SplunkPower User
- SplunkAdmin
- CriblStream
1 earned · 3 in progress
jigarhirani.tech · © 2026