At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents with Agent Launchpad. Participants tackled familiar challenges across IT operations, Splunk administration, security operations, network operations and the new-user experience.
Agent Launchpad is located in the Splunk AI Toolkit app and gives practitioners a no-code way to build AI agents around the operational work they already understand. Builders define an agent’s role, instructions and reusable skills, then connect it to approved tools that let it work with Splunk data.
The AI Agent Buildathon allowed participants to use NVIDIA Nemotron open model, AWS Bedrock, and Splunk MCP tools to discover indexes and sourcetypes, run SPL searches, inspect metadata and retrieve saved-search configurations. Agent Launchpad orchestrated those tool calls, passed the results back to the agent and preserved a reviewable record of what the agent did. Agents could be run conversationally or invoked from SPL, saved searches and alerts, allowing builders to place them directly inside existing workflows.
The result was an impressive range of agents designed to investigate issues, diagnose searches, generate threat intelligence and help teams move from signal to action.
AI Agent Buildathon: Grand Prize Winners
Give it up for our five grand prize winners by category and check out the full gallery of AI Agents from the Buildathon for inspiration!
New Splunk Users: SearchDoctor by Dionysius (Sudofy)
Nearly every Splunk user has encountered a search that returns no results and wondered whether the data is missing or the search itself is broken. SearchDoctor takes the guesswork out of troubleshooting.
SearchDoctor diagnoses Splunk searches that return no results. It tests each clause independently to determine whether part of the search is faulty, the clauses conflict or the requested data is not present. The agent identifies every issue in one pass and returns a corrected, verified search. Users invoke it by opening the agent and providing the search they need help troubleshooting.
Splunk Administrators: ScheduledSearchDoctor by Will Searle
Scheduled searches can fail quietly. Some are repeatedly skipped, some return zero results on every run and others consume significant resources without producing useful output.
ScheduledSearchDoctor finds scheduled searches that fail quietly, including searches that are repeatedly skipped, return zero results or consume excessive resources. It examines scheduler and audit data, reads the affected search definition, and recommends a fix. It can run automatically from a daily saved search, with the alert passing details about the failing search directly to the agent.
Security Operations: stixForge by Steve Baker
Security investigations often end in written reports that another security tool cannot readily process. stixForge turns investigation findings into portable, machine-readable threat intelligence.
stixForge validates observables against Splunk results, maps behavior to MITRE ATT&CK and produces a STIX 2.1 bundle containing indicators, relationships and a narrative report. It can run in discovery mode from an SPL search, receive seed information from search results or launch from an Enterprise Security notable using the Run AI Agent alert action.
IT Operations: BigSmoke by Brad Levicky
When an alert arrives at an awkward hour, the first challenge is turning a vague symptom into a useful starting point. BigSmoke acts as an on-call companion, examining the timeline, identifying who and what may be affected, and locating the most relevant Splunk telemetry.
BigSmoke establishes the timeline and scope, finds relevant Splunk telemetry, and reports its evidence, confidence and recommended next action. The agent clearly distinguishes observed facts from hypotheses so engineers know how far to trust its conclusions. It is invoked conversationally by asking a question about the environment.
Cisco Integrations: Pathfinder by Simon Spehar
When a site turns red, network teams may need to assemble clues from several Cisco systems before they can begin resolving the problem. Pathfinder brings those signals together into one structured investigation.
Pathfinder investigates network health issues across Cisco SD-WAN, ThousandEyes and Catalyst Center data. It aligns signals on one timeline, identifies the likely cause and delivers a ticket-ready verdict with evidence, affected scope, remediation steps and ruled-out alternatives. The agent is invoked through the aiagent SPL command with a network health prompt and follows a consistent nine-search investigation process.
Build Your Own Working AI Agent
These projects demonstrate what becomes possible when the people closest to operational problems can build agents around the work they know best.
Agent Launchpad, available in the Splunk AI Toolkit app, provides a no-code environment for creating, testing, running and reviewing governed AI agents directly in Splunk. Agents can use Splunk data, reusable skills, knowledge bases and approved MCP tools, and they can be launched from searches, saved searches and alerts. Teams can automate repetitive investigative work while retaining visibility into the evidence and tools used during every run.
Check out the full gallery of AI Agents from the Buildathon for inspiration!
Ready to build an agent of your own? Download the Splunk AI Toolkit from Splunkbase and explore the Agent Launchpad documentation to learn how to connect models, skills, knowledge sources and MCP tools.
... View more
