splunk · aurbiztondo-splunk · Mar 5, 2025 · Jan 11, 2025 · Jan 11, 2025 · Jan 25, 2025
@@ -7,22 +7,21 @@
 Maximum number of metric time series processed in a signal
 *****************************************************************
 
-To maximize responsiveness when processing incoming metric data, Splunk Observability Cloud limits the number of :term:`metric time series` (MTS) processed in a signal
-(single plot line) on a chart or detector. If the total number of time series for the metric specified in your signal exceeds this limit, Splunk Observability Cloud displays
-an orange border around the MTS number. This border notifies you that the processed data reflects only a subset of the time series in the data.
+To maximize responsiveness when processing incoming metric data, Splunk Observability Cloud limits the number of :term:`metric time series` (MTS) processed in a signal (single plot line) on a chart, detector, or navigator. If the total number of time series for the metric specified in your signal exceeds this limit, Splunk Observability Cloud displays a message at the top of the chart, detector, or navigator. This message notifies you that the processed data reflects only a subset of the time series in the data.
 
-To ensure that your charts and detectors are processing all the time series in the data, apply as many filters as necessary to make the MTS number less than the maximum.
-You'll know you've succeeded when the orange outline around the MTS number and the message at the top of the chart or detector no longer appear.
+To ensure that your charts, detectors, and navigators are processing all the time series in the data, apply as many filters as necessary to make the MTS number less than the maximum. You'll know you've succeeded when the message at the top of the chart, detector, or navigator no longer appears.
 
-For example, suppose you want to display the sum of available disk capacity per availability zone. You might use ``df.complex.free`` as your signal,
-then apply the Sum analytics function, grouped by availability zone. If you have a large number of disks, the number of MTS returned by this signal might
+For example, suppose you want to display the sum of available disk capacity per availability zone. You might use ``df.complex.free`` as your signal, then apply the Sum analytics function, grouped by availability zone. If you have a large number of disks, the number of MTS returned by this signal might
 exceed the limit. To reduce the number of MTS, use filters and multiple plots instead of the group-by option in the Sum analytics function.
 
+Use filters and multiple plots on charts and detectors
+========================================================
+
 To use filters and multiple plots instead of the group-by option, follow these steps:
 
 #. Apply a filter for the plot that selects a single availability zone, then use the Sum analytic function without the group-by option.
 #. At the end of the plot row, select :guilabel:`Configure plot` to open :guilabel:`Visualization Options`, then select a color from :guilabel:`Plot Color`.
-#. Clone the plot. To do this, open the :guilabel:`plot actions` menu at the end of the plot row in the :guilabel:`Plot Editor`,
+#. Clone the plot. To do this, open the :guilabel:`Plot actions` menu at the end of the plot row in the :guilabel:`Plot Editor`,
    then select :menuselection:`Clone`.
 #. In the cloned plot, change the availability zone filter to select another availability zone, and change the :guilabel:`Plot Color` to give the cloned
    plot a color that's different from the original plot.
@@ -31,3 +30,8 @@ To use filters and multiple plots instead of the group-by option, follow these s
 The result is one chart with a separate plot line for each availability zone. Each plot line has a distinct color.
 
 For more information on filtering, see :ref:`filter-signal`.
+
+Use filters on navigators
+=============================
+
+To use filters on navigators, see :ref:`add-filter`.
@@ -24,8 +24,8 @@ send data to Infrastructure Monitoring.
 
 When a host uses the token to send data, Infrastructure Monitoring compares the
 token limits to all hosts' cumulative resource usage that use the token. When cumulative
-resource usage exceeds the limit, Infrastructure Monitoring issues an alert and
-stops ingesting data sent by hosts using the token.
+resource usage exceeds the limit, Infrastructure Monitoring issues an alert but continues
+ingesting data for some time. If this continued ingestion causes a system overage, contact Support. See :ref:`support`.
 
 Because the limits for one access token don't affect limits for other access tokens,
 you can set different limits for different types of hosts. For example, set high

@@ -17,7 +17,7 @@ Instrument Node.js applications for Splunk Observability Cloud
    Manual instrumentation <instrumentation/manual-instrumentation>
    Configure the Node.js agent <configuration/advanced-nodejs-otel-configuration>
    Performance overhead <performance>
-   Version 2.X <version-2x/get-started>
+   Version 2.X (deprecated) <version-2x/get-started>
    Splunk OTel JS 3.0 breaking changes <breaking-changes>
    Troubleshoot the Node.js agent <troubleshooting/common-nodejs-troubleshooting>
    About Splunk OTel JS <splunk-nodejs-otel-distribution>

@@ -21,7 +21,11 @@ Instrument Node.js applications for Splunk Observability Cloud
    About Splunk OTel JS <splunk-nodejs-otel-dist.rst>
    Migrate from the SFx Tracing Library <troubleshooting/migrate-signalfx-nodejs-agent-to-otel.rst>
 
-.. note:: The Splunk OpenTelemetry JS version 3.0 contains a set of breaking changes. To view these changes and learn how to update to version 3.0, see :ref:`nodejs-3x-breaking-changes`.
+.. caution:: 
+
+      The Splunk Distribution of OpenTelemetry JS version 2.X is deprecated as of February 28, 2025 and will reach end of support on February 28, 2026. Until then, only critical security fixes and bug fixes will be provided.
+
+      New customers should use the Splunk OpenTelemetry JS agent version 3.0. Existing customers should consider migrating to Splunk OpenTelemetry JS 3.0 or higher. See :ref:`nodejs-3x-breaking-changes`.
 
 The Splunk Distribution of OpenTelemetry JS provides a Node.js SDK that automatically adds APM instrumentation to your Node.js application. The instrumentation captures traces, runtime metrics, and CPU and memory profiles and sends them to Splunk Observability Cloud.
 

@@ -74,7 +74,7 @@ Follow these steps to automatically instrument your application using the Python
 
    .. code-block:: bash
 
-      opentelemetry-bootstrap
+      opentelemetry-bootstrap -a install
 
    To print the instrumentation packages to the console instead of installing them, run ``opentelemetry-bootstrap --action=requirements``. You can then add the output to your requirements or Pipfile.
 

@@ -60,7 +60,7 @@ See the following table for a list of changes:
       - Activates the Splunk OpenTelemetry Python agent and sends traces and metrics to Splunk Observability Cloud. 
     * - ``splunk-py-trace-bootstrap``, ``splk-py-trace-bootstrap``
       - ``opentelemetry-bootstrap``
-      - Installs instrumentation libraries and dependencies for Splunk OpenTelemetry Python.
+      - Lists instrumentation libraries and dependencies for Splunk OpenTelemetry Python. To install the libraries and dependencies, use ``opentelemetry-bootstrap -a install``.
 
 .. _python-2.x-new-functions:
 

@@ -15,6 +15,12 @@ Instrument Python applications for Splunk Observability Cloud
    Configure the Python agent <advanced-python-otel-configuration-1x>
    Metrics and attributes <python-otel-metrics-1x>
 
+.. note:: 
+
+   The Splunk Distribution of OpenTelemetry Python version 1.X is deprecated as of February 28, 2025 and will reach end of support on February 28, 2026. Until then, only critical security fixes and bug fixes will be provided.
+
+   New customers should use the Splunk OpenTelemetry Python agent version 2.0. Existing customers should consider migrating to Splunk OpenTelemetry Python 2.0 or higher. See :ref:`python-migration-guide`.
+
 The Splunk Distribution of OpenTelemetry Python provides a Python agent that automatically adds APM instrumentation to your Python application. The instrumentation captures distributed traces and metrics and sends them to Splunk Observability Cloud.
 
 To instrument your Python application, follow these steps:

@@ -102,11 +102,7 @@ Chatid is the unique identifier for each conversation in AI Assistant in Observa
       <h2>Data sharing and use<a name="data-sharing-and-use" class="headerlink" href="#data-sharing-and-use" title="Permalink to this headline">¶</a></h2>
     </embed>
 
-When you interact with AI Assistant in Observability Cloud, Splunk collects and might use inputs, outputs, grounding data, feedback, and usage data to provide and maintain the the AI Assistant, comply with applicable law, enforce our policies, and develop and improve the AI Assistant in Observability, including to train AI models.  
-
-If you do not want your data used for these purposes, do not click on the button and do not install, download, access, or otherwise use AI Assistant in Observability. 
-
-The following table explains the categories of data the AI Assistant collects:
+The following table explains the categories of data that the AI Assistant uses, collects, or generates:
 
 .. list-table::
    :header-rows: 1
@@ -125,13 +121,21 @@ The following table explains the categories of data the AI Assistant collects:
    * - Usage data
      - Usage data is more fully described in the Splunk Privacy Statement. Examples include “thumbs up”, “thumbs down”, “chat id”, “copy”, “tokens used”, and “response length”. 
 
-You can activate and deactivate data sharing by going to :guilabel:`Settings`. On the General Organization Settings page, go to the AI Assistant Management section. Select or deselect :guilabel:`AI Assistant in Observability` to activate or deactivate the AI Assistant for your organization. 
+When you use the AI Assistant, Splunk relies on certain essential types of data to provide the service and to enforce compliance with Splunk policy and applicable law; this includes user inputs, outputs, grounding observability data, and usage data (“essential purposes”). If you use the AI Assistant in Observability Cloud, you are agreeing to the essential purposes.
+
+In addition to the essential purposes, you also have the option of allowing Splunk to use the data collected by the AI Assistant for the additional purpose of conducting research and development on the AI Assistant and generative AI in general. This use of your data is optional, and you can choose to allow or disallow it by updating your settings. To manage your AI Assistant settings, follow these steps:
 
-If you do not want to share your data, deselect :guilabel:`Allow my AI service data to be used for research and development purposes`.
+1. Go to :guilabel:`Settings` in Splunk Observability Cloud. 
+
+2. On the :guilabel:`General Organization Settings` page, go to the :guilabel:`AI Assistant Management` section and select or deselect :guilabel:`AI Assistant in Observability` to activate or deactivate the AI Assistant in Observability Cloud for your organization. Note that any use of the AI Assisstant in Observability Cloud requires Splunk's use of your data for the essential purposes. If you do not wish to allow Splunk to use your data for the essential purposes, do not activate the AI Assistant or otherwise use the AI Assistant in Observability Cloud.
+
+3. If you do not want to allow usage of your data for research and development, deselect :guilabel:`Allow my AI service data to be used for research and development purposes`.
 
 .. image:: /_images/get-started/activate-assistant.png
   :width: 70%
-  :alt: This screenshot shows how Splunk Observability Cloud products serve the different layers and processes in an organization's environment.
+  :alt: This screenshot shows how to activate or deactivate the AI Assistant in Observability Cloud, as well as how to control whether your data is used for training the Assistant.
+
+For detailed data usage information, see :new-page:`Splunk Offerings Usage Data <https://trustportal.cisco.com/c/r/ctp/trust-portal.html?search_keyword=splunk#/19239883822949956>`.
 
 .. raw:: html
 

@@ -9,4 +9,13 @@ Ensure the correct mapping of your severity key
 
 The Log Observer Connect timeline displays a histogram of logged events over time, grouped by values of the message field :guilabel:`severity`. The severity key is a field that all logs contain. It has the values :guilabel:`DEBUG`, :guilabel:`ERROR`, :guilabel:`INFO`, :guilabel:`UNKNOWN`, and :guilabel:`WARNING`. Your logs might use a different field name for the severity key. Because the severity key in many logs is called :guilabel:`level`, Log Observer Connect automatically remaps the log field :guilabel:`level` to :guilabel:`severity`.
 
-If your logs call the severity key by a different name, that's okay. To ensure that Log Observer Connect can read your field, transform your field name to :guilabel:`severity` or add a :guilabel:`severity` alias to your field name. To transform your field name, see :new-page:`Extract fields from event data using Ingest Processor <https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/IngestProcessor/FieldExtractionPipeline>`. To add an alias to your field name, see :ref:`logs-alias`.
+If your logs call the severity key by a different name, that's okay. To ensure that Log Observer Connect can read your field, transform your field name to :guilabel:`severity` or add a :guilabel:`severity` alias to your field name. To transform your field name, see :new-page:`Extract fields from event data using Ingest Processor <https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/IngestProcessor/FieldExtractionPipeline>`. To add an alias to your field name, see :ref:`logs-alias`.
+
+The mapping of your severity key and its values is case sensitive. The key and its values must appear exactly as follows:
+
+* severity
+* DEBUG
+* ERROR
+* INFO
+* UNKNOWN
+* WARNING 
@@ -44,6 +44,12 @@ To access usage analytics in Splunk Observability Cloud, follow these steps:
 #. Under :guilabel:`Data Configuration`, select :guilabel:`Metrics Management`.
 #. Select the :guilabel:`Usage analytics` tab.
 
+.. caution:: The following message displays if you've sent too many queries in a short time period. If you see this message, reload the page after 2 minutes.
+
+  .. image:: /_images/infrastructure/rate-limiting-mua.png
+    :width: 80%
+    :alt: The rate limiting message in Splunk Observability Cloud.
+
 The usage analytics home page contains the following visualizations:
 
 * A card displaying the average number of metric time series (MTS) per hour for your selected time frame.

@@ -86,4 +86,4 @@ When Splunk removes support for a feature, platform, or browser it means that th
         * :ref:`manual-android-instrumentation`
         * :ref:`configure-ios-instrumentation`
         * :ref:`rum-ios-data`
-        * :ref:`manual-rum-react-instrumentation`
+        * :ref:`manual-rum-react-instrumentation`
@@ -0,0 +1,26 @@
+.. _2025-3-rn:
+
+*********************
+March 2025
+*********************
+
+Splunk Observability Cloud released the following new features and enhancements in March 2025. This is not an exhaustive list of changes in the observability ecosystem. For a detailed breakdown of changes in versioned components, see the :ref:`list of changelogs <changelogs>`.
+
+.. _2025-3-4-rn:
+
+March 4, 2025 release
+=======================
+
+.. list-table::
+   :header-rows: 1
+   :widths: 1 2
+   :width: 100%
+
+   * - New feature or enhancement
+     - Description
+   * - Splunk Observability Cloud AI assistant in Splunk Cloud Related Content
+     - Splunk Cloud Platform users can speed up root cause analysis and IT investigations in the Search app with a new :guilabel:`AI Assistant` tab in the :guilabel:`Related Content` panel. Now the :guilabel:`Related Content` panel shows you not only the context of your issues with observability data, but also provides troubleshooting steps and additional information about the health of your services on the :guilabel:`AI Assistant` tab. Available for customers who have AI Assistant in Observability Cloud and Unified Identity enabled.
+   * - Synthetics Downtime Configurations
+     - Splunk Synthetic Monitoring now supports recurring downtime configurations. Recurring downtimes allow you to sync with your scheduled maintenance windows or planned/unplanned downtimes and keep them from impacting your monitoring metrics or SLAs.
+   * - Synthetics multi-factor authentication (MFA)
+     - Splunk Synthetic Monitoring now supports tests that need to send a time-based one-time passcode (TOTP) to their test target.
@@ -10,6 +10,7 @@ Release notes overview
 .. toctree::
    :hidden:
 
+   2025-3-rn
    2025-2-rn
    2024-11-rn
    2024-10-rn
@@ -29,6 +30,8 @@ Each release date includes new features and enhancements for SaaS and versioned
 
    * - Release month
      - Release date
+   * - :ref:`2025-3-rn`
+     - * :ref:`2025-3-4-rn`
    * - :ref:`2025-2-rn`
      - * :ref:`2025-2-4-rn`
    * - :ref:`2024-11-rn`
@@ -76,4 +79,4 @@ For a detailed breakdown of changes in versioned components, see the following t
    * - Splunk OpenTelemetry iOS instrumentation
      - :new-page:`https://github.com/signalfx/splunk-otel-ios/blob/main/CHANGELOG.md`
    * - Splunk OpenTelemetry React Native instrumentation
-     - :new-page:`https://github.com/signalfx/splunk-otel-react-native/blob/main/CHANGELOG.md`
+     - :new-page:`https://github.com/signalfx/splunk-otel-react-native/blob/main/CHANGELOG.md`
@@ -141,7 +141,7 @@ You can also call the endpoint using cURL commands. For example:
    curl -X POST -d ‘{“entity_id”:“ID of the
    incident”,“message_type”:“critical”,“state_message”:“hi, this is some
    state message.”}'
-   https://alert.Splunk On-Call.com/integrations/generic/20131114/alert/[YOUR_REST_ENDPOINT_KEY]/[ROUTING_KEY_HERE]
+   https://alert.victorops.com/integrations/generic/20131114/alert/[YOUR_REST_ENDPOINT_KEY]/[ROUTING_KEY_HERE]
 
 Annotations
 ===========