What's New We’re excited to announce the latest enhancements to Splunk Observability Cloud and share what’s currently in preview across the Splunk Observability portfolio. These innovations are designed to help you correlate user behavior with system performance data faster,  enhance performance analysis, and leverage Observability Cloud data across Splunk Cloud and local AI agents, LLMs, and tools, and data. The following features became generally available on March 18, 2026.   Feature Highlight  Prioritize decisions based on real user impact with Digital Experience Analytics Teams can now understand real user behavior to drive digital growth with Digital Experience Analytics. Digital Experience Analytics empowers teams to track feature usage, visualize user journeys, monitor conversions, and surface friction that impacts business outcomes. They can also uncover the why behind user behavior with Session Replay, pairing quantitative data with real-world context to instantly replay moments of friction and see exactly what users clicked, scrolled, hesitated on, or abandoned. By correlating user behavior with system performance data to remove friction, prioritize impact, and reduce operational toil – all with minimal instrumentation – teams can focus on the work that matters most for users and the business.   This feature will be rolled out to select customers in us0, us1, and eu0 in March 2026, with other realms to follow soon. Learn more in our blog post and documentation.    Additional Releases Quickly find and fix frontend performance issues using natural language with the AI Assistant in Real User Monitoring (RUM) Teams can now use the AI Assistant in Observability Cloud to quickly explore RUM data. To troubleshoot frontend performance, JavaScript, and user behavior errors, teams can use natural language to chat with and surface key insights about their RUM data. With in-context metrics and attributes, as well as guided recommendations, the AI assistant in RUM helps accelerate investigation across apps, metrics, tags, and time windows, reducing both mean-time-to-detection (MTTD) and mean-time-to-resolution (MTTR). Learn more in the documentation.   Google Cloud Platform (GCP) customers using Splunk Observability Cloud can now archive and restore histogram metrics in Usage Analytics In Usage Analytics, customers can: Identify primary cost drivers Analyze metric and dimension utilization Determine whether specific metrics or dimensions are used in detectors or charts Identify data that consumes license capacity without providing operational value Based on this analysis, customers can archive (including histogram metrics) or aggregate unused data using Metric Pipeline Management. Archived metrics can be restored when needed. This capability enables more controlled management of metric storage and license consumption. This feature was previously available only to Splunk and AWS customers, but it is now available to Google Cloud Platform (GCP) customers using Splunk Observability Cloud. Read the blog to learn more about Usage Analytics.   Enhance performance analysis efficiency using high-level summaries to reduce noise and identify bottlenecks with Call Graph Usability We’ve updated the Call Graphs functionality with a new summary view that provides an immediate, high-level overview of method performance. Instead of manually scrolling through extensive data, you can now see the top five methods consuming the most execution time at-a-glance - significantly minimizing the time required for troubleshooting by highlighting critical performance data upfront. Furthermore, we’ve added the capability to exclude specific packages—such as third-party library methods or Java methods that are outside the user's control. By allowing users to hide these non-essential elements, the Call Graphs become more concise and readable, ensuring that SREs and developers can focus their attention on the code and services they can influence or optimize. Learn more in the documentation.   Use Business Transaction (BT) Rule Enhancements to optimize and achieve targeted discovery Business Transactions in Observability Cloud groups related traces that represent discrete user flows – like User Registration, Add to Cart, or Complete Purchase. They turn your distributed microservice traces into meaningful business processes you can watch and optimize. Business transaction rules are the key to discovering your high-value business transactions. However, using full URI segments (the default), often led to an overwhelming number of BTs depending on the organization's URL structure. Now, the default rule is now fully editable, allowing you to improve discovery by using the first two (recommended) URI segments, which is often sufficient for identifying meaningful business transactions that align with your specific organizational needs. This update reduces the noise of unnecessary BTs, allowing teams to focus on the transactions that truly matter without the manual overhead of creating custom rules for every service. Learn more in the documentation. Endpoint grouping is another new enhancement that allows you to create custom rules for any service to group related endpoints together, such as combining GET and POST requests. This capability is essential for teams struggling with high cardinality, where the sheer volume of unique endpoints makes monitoring difficult and consumes excessive resources. By grouping these endpoints, users can significantly reduce the total number of business transactions, preventing the "BT explosion" that often complicates observability environments. Endpoint Grouping also allows for flexible naming and grouping based on URI segments or indexed tags, ensuring that the resulting data is both organized and actionable. Ultimately, this leads to a cleaner, more efficient monitoring dashboard where metrics are aggregated into a single, relevant entity rather than being fragmented across hundreds of disparate, low-value endpoints. Learn more in the documentation.   Retrieve audit logs using optional filtering, pagination, and sorting with the Audit Events API Splunk customers can now use the self-service Audit Events API to access their Splunk Observability Cloud audit logs. They can fetch an organization's audit trail with new API, making it easy to retrieve, filter, and analyze system activities and user actions within Splunk Observability Cloud. Customer audit events include configuration changes to dashboards, dashboard_group, detector, org_member, integration and SLO. Users can also access session and user details with HTTP requests. Learn more in the documentation.   Connect your AI agents to Observability Cloud capabilities on Splunk MCP Server AI agents now have one unified MCP server to access Splunk’s tool capabilities. Splunk MCP Server provides a secure and scalable interface for connecting AI assistants, agents, and other intelligent systems to Splunk data, and now specifically to Observability Cloud capabilities. This provides teams with the flexibility to seamlessly integrate their local AI agents, LLMs, and tools, and data with Observability Cloud data to build custom AI workflows and debug performance issues in production without leaving their environment. Learn more in the documentation.   Access multiple Observability Cloud orgs in Related Content, Search & Reporting, and Dashboard Studio in Splunk Cloud Previously, a Splunk Cloud instance could only show data from a default Observability Cloud org selected in the Discover Splunk Observability Cloud app. With multiple isolated Observability Cloud orgs, there was no way to surface and correlate the metrics, traces, and logs across them. Now, users can correlate the default Observability Cloud org with their preferred org used in Related Content, Search & Reporting, and Dashboard Studio. By switching between their Observability Cloud orgs on the fly, users can leverage and correlate data faster. Additionally, users can create a single dashboard and visualize data across multiple Observability Cloud orgs without context switching. Learn more in the documentation. What’s in Preview Now   Mobile Real User Monitoring Hybrid Framework Support  Developers can now leverage Splunk Observability for mobile apps built with React Native and Flutter, with the same out-of-the-box metrics provided for native iOS and Android apps, and see all of their mobile observability data in a unified view. Sign up on this page.  ITSI Episode Summarization  Episode summarization provides enterprise support teams with accurate, concise, and contextually rich episode summarization and basic root cause analysis by leveraging LLMs, cutting down the number of clicks from 8-10 down to 1 to get the most relevant context of an episode, including actionable insights. Sign up on this page.  Business Insights in Observability Cloud Alpha Program  Business Journeys, the key feature of Business Insights in Splunk Observability Cloud, empowers business owners and product managers to visualize, analyze, and optimize end-to-end business processes. Leveraging APM and RUM data, it simplifies troubleshooting by correlating technical performance with business impact. Features include up to 50 milestones, auto-discovery, and multi-application connection via transition keys, enabling cloud-based business process optimization. Sign up on this page.  Don’t miss the next post. Here’s how to subscribe to this blog and get notified when new content goes live.  ... View more

What's New We’re excited to announce the latest enhancements to Splunk Observability Cloud and share what’s currently in preview across the Splunk Observability portfolio. These innovations are designed to help you resolve database performance issues faster, seamlessly correlate and search relevant logs in APM and Infrastructure Monitoring, and monitor your cloud services more easily. The following features became generally available on November 13, 2025.  Feature Highlight  Analyze your dimensions and metrics with Usage Analytics  To help optimize telemetry data volume, Usage Analytics offers two complementary analytical views:  Individual metrics – This view provides insights into key numerical statistics, their utilization, associated dimensions, and specific components such as Detectors, Dashboards, and Charts in which they are used. The gathered information helps identify potential areas to optimize data consumption, specifically high-cardinality metrics that are not actively used.   Individual dimensions – This view gives teams the ability to analyze usage of each dimension available in the system, both at a global level and within the context of specific metrics. Similarly to metrics, the Dimensions view provides detailed insight into dimensional statistics, their utilization, and lists all the components where they are used. Identified unused dimensions can be removed from specific metrics with Metric Pipeline Management.   Learn more in our documentation.    Additional Releases  Observability for AI: Infrastructure Monitoring Dashboard Support  We’ve added navigator and dashboard support for more AI technologies to ensure teams can monitor the health, availability, and resource utilization of AI components. With AI Infrastructure Monitoring, teams can now get visibility into their Cisco AI Pods, Nvidia NIMs, Milvus and Pinecone vector databases, LiteLLM proxy services, GCP VertexAI applications, and LangChain large language models (LLMs). Learn more in our documentation.     Simply search for relevant data with Default / Bundled (App) and Archived Metrics in Metrics Usage Analytics (MUA)   Now teams have greater visibility into their metrics usage to understand what impacts cardinality spikes the most with a broader set of metrics available in Usage Analytics:  Billing class: Default/Bundled (App) – This is an addition to the existing metrics from: Custom, Other, and Default/Bundled (Infra) billing classes.  Data route: Archived – A new data route type is also supported by the new filtering functionality – based on both available data routes: Real-time and Archived.   Finally, the currently displayed number of Metric Time Series (MTS) will be adjusted according to the following billing formulas:  1 histogram MTS will be counted as 8 MTS  1 archived MTS will be counted as 1/10 of an MTS.   Learn more in our documentation.     Easily test SSL certificates and run tests on-demand with Synthetic Monitoring  We’re introducing two new capabilities in Synthetic Monitoring: SSL Certificate Tests and Run Now.  SSL Certificate Tests is a new test type that lets you verify the validity, expiration, and configuration of your SSL/TLS certificates. Monitor certificates proactively and get alerted about issues such as upcoming expirations, misconfigurations, or revocation before they impact your users. Learn more in our documentation.  Run Now extends the existing Try Now experience by allowing you to execute synthetic tests on demand. When you trigger a test from the test summary page, the on-demand run is now saved to the run results list so you can easily review and share the details. This gives you the flexibility to run tests anytime and immediately analyze results without relying solely on scheduled runs. Learn more in our documentation.    Never miss an issue with reminder notifications for Alerts  Ensure your team doesn’t miss critical alerts, even if the first notification was overlooked. If the alert hasn’t yet been resolved, reminder notifications let you automatically resend alert notifications, so your team stays on top of important issues. Easily enable reminder notifications when setting up detectors and choosing notification recipients in Splunk Observability Cloud - whether through the UI or with Terraform – and choose both how often reminders are sent and how long they continue.  Learn more in our documentation.    Connect application and database performance with APM-Database Monitoring Trace Correlation  This new feature integrates Application Performance Monitoring (APM) with database correlation to enhance troubleshooting for business transactions and services. SRE and API service teams will be able to identify whether database issues, specifically with SQL databases, are causing problems such as latency or errors by efficiently linking application performance alerts to specific database queries. This capability improves root cause analysis and accelerates resolution of database-related performance problems. At the trace level, when a database span is present, normalized query details are displayed if correlation data is available, sampled every 10 seconds. By clicking, "View normalized query" teams can see detailed query information and navigate back to the trace. From the business transaction view, critical alerts can be investigated by drilling down to trace-level database correlations. Determining if specific SQL servers are the root cause of performance issues is made easier from the service map perspective. Learn more in our documentation.     Correlate service instances with infrastructure data to ensure scale and reliability  This new comprehensive service-centric view within the Instances tab empowers SREs and DevOPs teams to correlate service instance IDs with Kubernetes pod IDs and associated infrastructure data. Teams can now gain real-time visibility into pod-level details such as pod ID, cluster name, phase, restarts, and key infrastructure metrics as services scale up or down—all in a unified dashboard. This integrated approach enables seamless troubleshooting and identification of service-level issues from underlying infrastructure and more, without context switching. Additionally, teams can view trend analysis over time and drill down into specific cluster, workload, or container metrics with a single click. Inspired by customer feedback and popularized in AppDynamics, this enhancement provides actionable insights for monitoring, root cause analysis, and infrastructure health, making it easier for organizations to maintain robust service reliability as their Kubernetes environments scale. Learn more in our documentation.     Securely send alert notifications from ServiceNow with OAuth2.0 support   Refreshed ServiceNow integrations deliver a cleaner, more consistent experience. Customize the payload sent to ServiceNow directly in the UI, both when creating and editing integrations, and connect using OAuth 2.0 for improved security. Learn more in our documentation.    Seamlessly view logs in a re-designed table  Previously on the Log Observer home page, log data was displayed using infinite scroll. Now, it is presented in a paginated view that displays 1,000 log records per page for improved performance, faster navigation, and clearer organization. Additionally, teams can determine which fields are represented in the table columns and in what order, rearrange and sort columns, adjust column width, and more for increased flexibility and visibility into log data. Teams have a similar experience viewing logs in APM and in Dashboards for a consistent and scalable log exploration experience across all views. Learn more in our documentation.     What’s in Preview Now   Observability AI Admin Assistant – Custom Role Creation and Management via MCP Sign Up  Splunk Observability Cloud admins can now create Custom Roles via an MCP to control granular read and write capabilities for end users to ensure appropriate access across the product, like having a user be able to create a dashboard but not an alert. Sign up on this page.   Splunk Observability Network Monitoring with Isovalent  Network Explorer in Splunk Observability can now help customers wanting deeper visibility into networks using eBPF. Sign up on this page.  ... View more