Top of mind questions asked during the AI-Powered Data Management Tech Talk   Q. When will these capabilities be Generally Available? A. Summer 2026 Q. How will this help me save time getting data in? A. Splunk is introducing key AI-Powered Data Management capabilities that leverage Large Language Models (LLMs) and generative AI, to replace manual, fragile, and expert-dependent tasks with automated, self-learning workflows, transforming raw, chaotic telemetry into trusted, analytics-ready intelligence in minutes rather than weeks. Customers can get excited because this is a productivity multiplier! It shifts the team’s focus from "data firefighting" to "data strategy," drastically accelerating their time-to-insight and ensuring security and observability content is always reliable. Check out the latest launch announcement. Q. In a situation where there is a Machine-to-Machine communication where public/private keys are used for data, is there a better way to capture the heartbeat of the target system than using a “degenerate” key missing message? Seems like this would obfuscate REAL errors that might occur? A. tstats may be worth considering as a practice for heartbeat/liveness monitoring in Splunk, given its performance characteristics (although I'm not sure if this fully answers the problem you're describing). Q. Can we create pipelines that strips / mask sensitive data before it ends up in a database? A.With EP/IP you can strip or mask data before sending to supported destinations. Q. Does this tool only work with datasets that you wish to be added to a Splunk data model? What if I want some of the functionality to do field extractions, etc without including the events in a Splunk data model? A. This can be done to, by selecting 'custom' schema in select data model screen. Q. Can we do nullqueue using this? A. Yes, that's supported. Q. How does it impact SVC ? A. Great question! We won't be able to answer that today since we are still in Alpha stage. That said, more information will be shared before the GA releases for all these features.     ... View more

    Sharing a few resources below to help you start transforming your data management strategy! Blogs: From Weeks to Minutes: Accelerating Data Intelligence with AI-Powered Data Management AI-Assisted Auto-Schematization for CIM The Complete Guide to Splunk Data Management Data Management Digest, a monthly lookback blog series: March 2026 Edition Lantern Article: Building a Data Management Strategy YouTube Demo Series: Data Management Made Easy ... View more

Sharing a few resources you might find interesting: Blogs:  Splunk AI Assistant for SPL 1.4 Brings Improved Accuracy and Optimization Via the Power of Agentic AI Agentic AI Explained: Key Features, Benefits, and Real-World Impact Product Tour: Splunk AI Assistant for SPL FAQ:  Splunk AI Assistant for SPL Documentation: Splunk AI Assistant for SPL     ... View more

You might find the live Q&A interesting. View questions submitted by your peers.   Q. What might make someone a good candidate for Splunk Observability for AI? A. If you're already running AI applications or have AI infrastructure, whether you're starting out or you're more mature in your AI journey, and if you're facing the same problems around not having any visibility or insights into not only performance, but also the cost, security or quality of responses, you're a prime candidate for observability for AI - AI Infrastructure Monitoring and AI Agent Monitoring. This is the solution to help you correlate those insights to your other meta data, your logs and traces, have it in one single view, and connect that key business metrics. Q. If I’m a Cisco customer, can I use Splunk Observability for AI to monitor my AI pods? A. Absolutely! If you're familiar with Cisco's AI PODS solution, or if you're not, it is a pre-configured packaged hardware solution for training and inferencing. So, it's an all in one solution using UCS hardware, Nexus switches, a storage provider, and, a number of GPUs coming from Nvidia. The hardware package is kind of the easy button for on-prem inferencing and training. Splunk Observability, is optimized for that solution. Using AI Infrastructure Monitoring, you can view out-of-the-box dashboard views around all of the technology in the Cisco AI as well as the technology that's coming from what you're building into the AI POD to run your application. Once you deploy the AI POD and configure out your observability, you can be up and running and inferencing in a matter of very little time.   Q. When will Observability for AI be GA? A. AI Infrastructure Monitoring is generally available today. Head to our docs to learn more and get started. AI Agent Monitoring is in Alpha and will be GA soon. You can sign up for the preview to get started here.    Q. What's the pricing model if I already have AppDynamics? A. Please talk to your Splunk Account Rep and to find out what the details are to get started with AI Agent Monitoring. If you're a Splunk AppDynamics customer, you should already have these capabilities, as they became GA in September 2025.    Q. For the agentic infrastructure monitoring, how is that enabled? A. The infrastructure monitoring components – all the dashboards and navigator views – is available to all customers. It will appear in your environment when you start sending data in. Head to the documentation, deploy open telemetry collector to go and collect information from your GPUs or any of the component technologies listed that you're collecting it from. Once you see that data pattern coming in, the dashboards and navigator views will appear in your environment.   Q. Once threat is detected in Splunk AI, is the platform have response for it? A. Yes - Through an integration with Cisco AI Defense, AI Agent Monitoring will detect and help prevent threats like privacy leakage or prompt injection. You will then have the ability to create a blocking policy.      Q. In what version is it ready to use now? A. It’s available now and the current version of that offering. We release continuously in our SAS environment, so we don't have Splunk version numbers for that. We do require that you use the latest version of the of the instrumentation libraries to be compatible with what we're releasing here on the application side. Definitely check the Splunk Observability Cloud release notes on that and then, in the instructions on what versions of instrumentation and receivers. Technology is evolving very, very rapidly in this space and with every biweekly release, we're adding support for new platforms and technologies and frameworks. So, it's going to be something to always be aware of!     Q. So will the Splunk AI Assistant for SPL intergrated into search without having to download externally from the Splunkbase? A. Yes, AI Assistant for SPL can now be integrated into search for a better search experience. However, it still requires an app download to allow us to interate and bring you the latest AI innovations quickly. We are exploring ways to make the AI Assistant for SPL a search default feature.    ... View more

View all the top of mind questions from the live event! Q. Are there controls in place that would allow an analyst to develop and create a new version of a detection but the ability to deploy is given to another user group (peer review)? A. With Splunk Enterprise Security 8.x we offer detection versioning with a lot of git-like features, but I do not believe there is any kind of dedicated merge request sort of flow.   Q. I've attended previous Tech Talks from Splunk about Risk-based Alerting. Does Finding-based detections tie into that? A. Yep! It is basically the next evolution of Risk Based Alerting making it far more natively integrated with the product. Q. Does the investigations workbench handle multi-tenancy? A. There are tools you can use to make separate queues and views for different teams but ES8's Analyst Queue does not yet include multi-tenancy as an out of the box feature. Q. Does the investigations workbench handle multi-tenancy? A. There are tools you can use to make separate queues and views for different teams but ES8's Analyst Queue does not yet include multi-tenancy as an out of the box feature. Q. How would ingestion of third party alerts that are already correlated into incidents (e.g. Defender XDR), be ingested and turned into findings? And is there functionality that mirrors the existing correlation from the source? A. There's a lot of flexibility that comes with Findings and Intermediate Findings. You can ingest things to 'alert' straight away or you can ingest things to not show up as an alert but build towards one. This means you can decide how to treat those alerts from a third party tool, and if the "pre-correlated" alerts include the context you could ingest that as well. Q. Can a finding group get more findings after the group is initially created? A. Yes! So Finding Groups are made to be added to within their window. You can also always add more Findings to an Investigation once you make one. Q. Can additional findings be added to a detection based on a reference number (e.g. 3rd party incident id) automatically? A. This is a very achievable thing leveraging Automation, e.g., the SOAR block for "add finding to investigation" or "add finding." There are some SPL-first mechanisms that may work. Come find me on Community Slack : @Drew Church and we can try and figure out more together. Q. What is the recommended process to restoring the nav bar after an upgrade? A. Post app install, you will need to go into the post-install upgrade routine. It will prompt you to reset to default. From there, you will need to use the Navigation Menu editor inside of Enterprise Security to add back in the customizations. Q. Any changes to Git Integration within Splunk Enterprise Security or Splunk SOAR on prem? A. Enterprise Security 8 does not have a git integration. There are no changes to Splunk SOAR (on-prem) or Splunk SOAR (Cloud) in terms of the git integration. ... View more

Hi @plaid_blanket, Thank you for your feedback. Introducing Splunk 10.0 - Smarter, Faster, and More Powerful Than Ever Tech Talk was made available on YouTube on September 3rd. You can view it directly on YouTube and we do hope that you find it valuable. Thanks again. ... View more

Resources to learn more and get started with automated threat analysis   Apps and add-ons: Splunk Attack Analyzer Connector for Splunk SOAR Splunk App for Splunk Attack Analyzer Splunk Add-On for Splunk Attack Analyzer   Blogs: Enhancing SIEM Events with Automated Threat Analysis of URLs Splunk SOAR Playboook of the Month: Splunk Attack Analyzer Dynamic Analysis Announcing General Availability of Cisco Talos Intelligence in Splunk Attack Analyzer Splunk Attack Analyzer Introduces Built-in Translation and Achieves SOC 2 Compliance   Lantern articles: Automate threat analysis Automating the investigation of emails for malicious content   ... View more

Hi @Lemine, Thank you for your interest in the  Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever Tech Talk. You should be able to view the on-demand recording on this page. Let me know if you have any additional questions. Thank you!    ... View more

Here are a few Splunk 10.0 resources that you might find interesting: Blogs:   Introducing Splunk 10 Importance of OpenSSL 3.0 Upgrade Readiness Blog   Data Management Blogs:   Capabilities expanded to include Ingest Monitoring Capabilities expanded to include Agent Management Introducing Edge Processor for Splunk Enterprise   Dashboard Studio Blogs: What’s New in 10.0 & 9.4? Spec-TAB-ular Updates   Release Notes:  Splunk Enterprise Splunk Cloud Platform   Start your Splunk Cloud free trial     ... View more

Hi @usd0872, Thank you for your interest in the  Introducing Splunk 10.0 Tech Talk. All registrants will receive a follow up email with a link to the recording. Lookout for the Thank you for your interest email and let us know if you have any questions ... View more

Here are a few more resources you may find interesting, enjoy! The SecOps Handbook to TDIR: Discover how to pare down systems and integrate tools across your enterprise environment. Blog Posts The TDIR Lifecycle: Threat Detection, Investigation, Response Innovations in Splunk Security Expands Unified TDIR Experience to On-Premises and FedRamp Moderate Environments Lantern: Automate complete TDIR life cycle ... View more

Here are a few resources you might find interesting: Product Documentation ThousandEyes Integration, Content Pack for ThousandEyes, ITSI Content Packs Preview Sign-up for Enterprise Networks Content Pack (Catalyst Center and Meraki in Splunk ITSI) Links to Splunkbase Apps: Meraki Technical Add-on, Catalyst Technical Add-on, Enterprise Networking App, ThousandEyes App   Blogs and Community Posts Why Modern Incident Response Strategies Need Network and Service Intelligence: Part 1 Why Modern Incident Response Strategies Need Network and Service Intelligence: Part 2 The Visibility Gap: Hybrid Networks and IT Services Almost too Eventful Assurance: Part 1 Almost too Eventful Assurance: Part 2   Reports State of the Observability Report 2024 ... View more

Additional Resources    Expert insights: Splunk Threat Research Team Blogs For enhanced insights from our Threat Research experts, explore their blogs. These offer in-depth analysis on use cases, detection strategies, and actionable playbooks, among others. The aim is to furnish tactical guidance that boosts customers' security operations, facilitating prompt detection, investigation, and response to emerging threats.  Monthly ESCU Update on Community Product News and AnnouncementExplore quarterly Security Content Roundup: Here  Explore the Splunk Threat Research Team Website Get the latest content update from our security experts in the form of detections, ML models, and SOAR Playbooks.  Check out additional Cybersecurity Content from SURGe: SURGe Security Team Website Research, cybersecurity insights and advice for making the most of Splunk Security. New Content from Splunk Threat Research Team: Check it out  Check out Splunk OnDemand Services : We support you with what you need, when you need it. ... View more

Splunk AI Assistant In Observability Cloud   Find and fix issues faster using natural language Surface key insights by chatting with your data Accelerate investigations and day-to-day monitoring tasks Get context and support as you troubleshoot   Watch Demo ... View more

Splunk Real User Monitoring All the context you need to deliver an amazing digital experience Built-in comparison with industry benchmarks and video replays to understand the experience from the user perspective Record every single transaction to eliminate the need to reproduce issues View transactions from the front end to their backend apps to understand the source of a problem ... View more

Splunk APM: Database Query Performance Accelerate troubleshooting - identify database issues See top queries in your environments: Total response time P90 for latency Total number of requests Requests per second Correlate database query performance with underlying infrastructure Watch Demo ... View more

Splunk APM: Service Centric Views Faster and simpler troubleshooting - All the data in one place Provides developers with all the telemetry they need to understand the performance of services they own:  Traces Profiles Logs RED metrics Runtime metrics Infrastructure metrics Alerts Watch Demo ... View more

Business Workflows Understand the performance of processes that matter to you Group together any combination of microservices that align to key functions performed by the backend (such as checkout, log-in, etc.) View RED metrics per Workflow Filter Service Map and Tag Spotlight based on Workflows   Watch Demo ... View more

Troubleshooting microservices is hard Too much data It’s hard to prioritize Too many tools Context gets lost Data is missing requires expertise   Observability Cloud packs a lot of capabilities to accelerate troubleshooting Business Workflows Service Centric Views Tag Spotlight Related content  DB monitoring  Real user monitoring AI Assistant   Want to learn more? Connect with your Splunk account team or sign up for a free trial! ... View more

Here are a few Cisco Talos Threat Intelligence resources: Blogs: Harness the Power of Cisco Talos Threat Intelligence Across Splunk Security Products  Announcing General Availability of Cisco Talos Intelligence in Splunk Attack Analyzer Documentation: Deploy Cisco Talos Intelligence for Splunk Enterprise Security (Cloud Only) Harness Cisco Talos Intelligence in Splunk SOAR (Cloud) ... View more

Below are a few more Splunk Enterprise 9.4 resources you may be interested in: Free Trial: Splunk Enterprise Documentation: Splunk Enterprise 9.4 Blog: Splunk Platform Use Cases, Written Just for You ... View more