I've been furloughed
It's official now, so I'll simply say that I've been furloughed. I'm certainly not alone, even in my company, and I'm still better off than many. It's worrying, but that isn't why I've been away.
I completed my Architect practical lab yesterday. (Or around 3am today, more precisely. I needed 18 of the 24 hours, in the end.) That's my shorthand for what Splunk calls their Splunk Enterprise Deployment Practical Lab Public Class, by the way. Quite a mouthful. It'll be a few days before I get my results. There isn't much feedback, apparently. And, they are completely upfront about it being a subjective evaluation, just as it would be with a customer, waiting to be paid.
I'm disappointed, regardless of the outcome. The whole process has highlighted some glaring gaps in my knowledge, particularly around apps and technology add-ons. I was deep on trying to extract fields from syslog before a colleague pointed out that putting the *nix TA on my search head would do the job for me. (I'd only installed it on the universal forwarder that was gathering the data.) And my regex is pitiful: I tried to use the Add Data wizard on a custom XML data source, and was so thrown by the stream of gobbledygook it spat out that I lost hours and never properly parsed the stuff, in the end. I tried to justify that point, amongst others, in my report to the 'customer'; we'll soon see how it all went down.
It was a real blow to my ego. Especially now, seeing my manager finish the same lab in seven hours today. I'm so impressed by her intelligence, work ethic and thought process, but, try as I might, I still use moments like this to knock myself down. Ah, well, I'm a work in progress, as we all are.
End of Day 29
(I know I've missed a few actual days, but I've decided to ignore the gap.)
— jlj@Fosstodon #100DaysToOffload
I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/