Splunk
Data platform for security and observability with agentic AI.
About
Splunk, now part of Cisco, is the data platform for machine data across security operations and observability. Cisco's .conf 2025 announcements repositioned Splunk as the connective tissue of its infrastructure portfolio, introducing a Cisco Data Fabric built on Splunk Enterprise and Cloud Platform with federated search and a planned time series foundation model.
The AI story spans the AI Assistant for SPL, which writes and explains Splunk queries in natural language, the Splunk AI Toolkit (formerly MLTK) with 50 plus algorithms for custom models, and a wave of agentic AI: a Triage Agent, Malware Reversal Agent, AI Playbook Authoring, and a Splunk MCP server. Enterprise Security now ships in Essentials and Premier editions with AI agents orchestrating threat detection, investigation, and response.
What it can do
- AI Assistant for natural-language SPL queries
- Splunk AI Toolkit with 50 plus ML algorithms
- Agentic Triage and Malware Reversal agents
- Splunk MCP server for AI agent integration
- Federated search across S3, Snowflake, and Azure
Setup
Deploy Splunk Enterprise or subscribe to Splunk Cloud Platform; install the AI Assistant and AI Toolkit apps from Splunkbase.
Prerequisites
Machine data sources to onboard and search head capacity for the deployment size.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 119; Trending score 78/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.