Hi everyone, 

Apologies for the delay in putting this event together and for the gap in meeting up for the summer.

Please join us at the Splunk London HQ in Paddington on September 18th for a chat from Gabriel Vasseur at Thales Group!

Title: Honey I shrunk the ingest! How we used ingest actions to reduce license usage and make the most of our data.

Abstract:

In case you don't know already, we'll demo how ingest actions work and what they can do. Then we'll share how we used them to shrink our license usage by nearly a third.

There are two things you can do to reduce your license usage: either don't ingest data you don't use, or remove useless bits from each event you ingest. In both cases, ingest actions can help in powerful ways.

We'll present examples ranging from "very reasonable" to "this is crazy! (but so tempting...)" covering various sourcetypes (WELs, sysmon, powershell, stream (DNS), firewall logs...).

This even will be hosted in person and hybrid. The meeting link will be sent out closer to the event.

For in-person attendance, please RSVP by September 17th at 4PM so we can plan numbers accordingly.