If you know iDelta, you know how much we love Splunk’s annual conference (see here for a reminder!). We are therefore very excited by the recent announcement that this year’s event, .conf21, is now free to attend online! This means that you can attend many of the Splunk .conf21 sessions, and all of the keynotes, for free.

To celebrate, we’ve taken a little look at this years programme and picked out some of the sessions we are excited about. This is by no means a comprehensive list – view the catalog here to see all of the Splunk .conf21 sessions.

iDelta’s .conf21 picks

Splunk Platform Admin

  • PLA1265C – Busting the Curve: Specific Techniques to Decouple Splunk Cost From Your Exploding Machine Data Volumes. This session promises to enable you to learn key techniques to reduce the cost of your Splunk platform, by exploring the inner workings of Splunk.
  • PLA1102B – Cloud Migrations Without the Migraine. Thinking about making the move from Splunk Enterprise to Splunk Cloud Platform? This talk looks at the process of migration.
  • PLA1410C – From Noob to Ninja: Growing and Managing Splunk Enterprise as a Team of One. Learn how to Splunk smarter, not harder, from someone who manages the entire Splunk deployment on their own, using ITSI, visualisations and automations to make the job easier.

Splunk Search / Dashboards

  • TRU1112B – Administrators Anonymous: Splunk Best Practices and Useful Tricks I Learned the Hard Way and PLA1264B – Best Practices and Better Practices for Admins. These sessions have appeared at several previous .confs, and are both really useful for anyone who wants to get the most out of their Splunk environment, covering common pitfalls and best practices.
  • PLA1811C – Build-A-Dashboard Workshop: Get Hands-on with Dashboard Studio. A hands-on demonstration of the new Dashboard Studio, to get you up-to-speed with creating impressive dashboards using this new feature. For a more advanced look at what the new Dashboard framework can do, see DEV1328C – How I Built It: Extending the New Dashboard Framework for Real-World Applications.
  • TRU1133B – Clara-Fication: More Tstats for Your Buckets. Learn more about the tstats command, and how you can use it to speed up your searches.

IT and Dev Ops

  • ITO1779C – An Introduction And What’s New Over The Past Year. If you use Splunk ITSI, or if you want to learn more about it, this talk is for you.This session looks at new features and promises to demo some of the latest and greatest features ITSI has to offer.
  • ITO1185B – Botify Splunk To Improve Collaboration, Cost and MTTR. This session looks really cool, as it looks at how a chatbot has been used as an intermediary between business users and Splunk, accelerating investigation and reducing the mean time to response.
  • DVO1261C – Extending Monitoring With Observability. Learn how to make the next steps from monitoring your environment to observability, allowing you to respond more quickly. If you are new to observability, DVO1111C – Getting Started With Splunk Observability may also be of interest.
  • DVO1227B – Splunk Real User Monitoring – Every Second Counts. Learn more about Splunk Real User Monitoring, which can help you to see how backend issues are affecting the end-user experience on your platform, and prioritise solving them before they become a major problem.


  • PLA1224B – 10GB to Workload Pricing: Our Journey in Getting Splunk Buy-In at Scale. This session looks one organisation’s journey from a thrown together tech stack to Splunk SOAR. Join this session for reflections on lessons learned from that process.
  • SEC1466A – A Deep-Dive Into How Zoom Is Building a World-Class Detection Pipeline in Response to the Zoom-Boom! Another fascinating look at a real-world use case for Splunk. This session will feature speakers from Zoom talking about how they have used Splunk to enhance their security after their massive explosion in popularity last year.

This list may look long, but it’s only a tiny percentage of the Splunk .conf21 sessions scheduled for this year. No matter what platform you are using, or where you are in your Splunk journey, there is bound to be something for you. There is, as usual, a mix of technical talks and explorations of use cases and Splunk journeys, covering any scenario you can think of. Check out the program today, and get signed up for this great event!

Posted by:Becky Nielsen

Becky is a certified Splunk Admin, who has been working for iDelta since graduating from CodeClan's Professional Software Development course in 2019. Previously an archivist at several institutions around the UK, she holds an MSc in Information Management and Preservation from the University of Glasgow.