We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization (Auto-schema) a new AI-powered experience in Splunk Data Management that helps administrators plan, parse, structure, and prepare data for Splunk faster.   For many teams, onboarding a new data source can mean inspecting raw events, identifying patterns, writing field extractions, mapping data to the Splunk Common Information Model (CIM), validating outputs, and packaging everything for deployment. Important work? Absolutely. Work everyone wants to do by hand every time? Not so much.  Guided Onboarding with Auto-schema significantly reduces that manual lift from weeks to minutes while keeping admins in control.  What Is Guided Onboarding with Auto-schema?  Guided Onboarding with Auto-schema brings assistant-guided workflows to common data onboarding tasks. The assistant gathers details through chat and structured prompts, then recommends onboarding strategies, generates task lists, or creates schema output based on the scenario you choose. Guided Onboarding with Auto-schema is part of Cisco Data Fabric powered by the Splunk Platform, transforming raw machine data into structured, high-quality, AI-ready intelligence through faster, simpler, and more precise data onboarding.  With this release, you can use guided workflows to:  Plan how to onboard a new data source  Schematize representative custom data  Generate CIM mapping recommendations  Create field extraction logic  Produce deployment-ready outputs such as add-on packages or SPL2 pipeline  Review and edit AI-assisted recommendations before using them  In short: bring representative data, answer guided questions, review the recommendations, and move from raw events toward search-ready data with less friction.  Two Workflows to Help You Get Data In  Guided Onboarding with Auto-schema includes two primary workflows: Plan data onboarding and Schematize custom data.  Scenario  Use this scenario to  Information to provide  Main output  Plan data onboarding  Create an onboarding plan for a data source.  Data source, platform, ingestion preference, volume, latency, and deployment model.  A task list, selected ingestion strategy, and topology information when available.  Schematize custom data  Generate CIM mappings and deployment files for a custom data source.  Destination, source type or source name, and representative sample events.  An add-on package, SPL2 output, or both output types depending on the selected destination.    The planning workflow is useful when you know the source you want to bring into Splunk but need a recommended path to get there. It helps clarify ingestion choices, deployment considerations, and the work required to make the data available.  The schematization workflow is useful when you have representative custom data and want help creating search-ready structure. Auto-schema can identify patterns in sample events, recommend mappings, and help generate outputs that fit the selected destination.  How to Access It  To get started, open the Data Management app in Splunk Cloud Platform. In the left navigation pane, select Scenarios.    OskarPatnaik_0-1785417677813.png Watch the Walkthrough  Want to see the full flow in action? The walkthrough demos show how Guided Onboarding with Auto-schema helps move from onboarding questions and representative events to recommended schema outputs and deployment artifacts.    See it in Action:    Plan Data Onboarding Demo → Schematize Custom Data Demo →  Responsible AI and User Control  Guided Onboarding with Auto-schema is part of Splunk's AI-powered Data Management capabilities. On first use, users see an AI consent prompt explaining that the feature uses Large Language Models. The prompt also explains that Splunk may process data directly relevant to the workflow, such as sample log data provided by the user and onboarding responses. Before continuing, users acknowledge the AI use and agree to Splunk's General Terms and Data Security & Privacy Commitment.  OskarPatnaik_1-1785417677814.png For more information, see Responsible AI for AI-powered Data Management. Availability  Guided Onboarding with Auto-schema is available for Splunk Cloud Platform customers in selected regions and requires Splunk version 10.4 or higher.  For the latest supported region list, see the Splunk documentation here. Start Onboarding Faster  Data onboarding is where so much Splunk value begins. Better structure means better searches, better detections, better dashboards, and better operational visibility.  Guided Onboarding with Auto-schema helps admins get there faster, with AI-assisted guidance, generated recommendations, and reviewable outputs that fit into real Splunk workflows.  Less time wrestling with raw data. More time getting value from it.  If you’re not subscribed, you’re probably missing something good. Fix that!  ... View more

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk administrators and security analysts, the path from raw data ingestion to actionable insight is often hindered by the complexity of data normalization. Manually building Technology Add-ons (TAs), writing complex regular expressions, and ensuring alignment with the Common Information Model (CIM) can take days, or even weeks, of focused effort.  Effective threat detection and high‑performance analytics depend on consistently structured data. By reducing the manual toil required to achieve “CIM‑compliance,” we can unlock faster time‑to‑value for security use cases. Key Takeaways AI-Driven Normalization: Automatically maps sample data to appropriate CIM data models using Large Language Models. Automated Extraction: Generates necessary extraction rules and regular expressions, significantly reducing manual regex authoring. Flexible Deployment: Produces both Technology Add-on (TA) packages for search-time mapping and SPL2 pipelines for ingest-time processing. Today, we are pleased to announce a significant step forward in simplifying this process: Alpha release of Auto-schematization in Data Management - an AI‑assisted workflow that accelerates CIM‑aligned onboarding while keeping humans in control.  The Challenge: Overcoming the Onboarding Bottleneck Effective threat detection and high-performance analytics depend on consistently structured data. However, the manual labor required to achieve "CIM-compliance" often delays time-to-value for new data sources. Our goal is to transform this experience from a manual, multi-tool mapping process into a streamlined, AI-assisted workflow.    The Solution: Automated Data Schematization  By leveraging Large Language Models, our new custom integration workflow automates the end-to-end schematization process. Whether you are dealing with structured logs or unique formats, the system provides:  Intelligent Data Model Mapping: The AI analyzes your sample data to automatically suggest the most appropriate CIM data models, ensuring your data is ready for CIM-normalized security detections.  Automated Field Extraction & Calculation: The system generates the necessary extraction rules and regular expressions, significantly reducing the need for manual regex authoring.  Flexible Deployment Artifacts: Depending on your data strategy, the tool generates either Technology Add-on (TA) packages for search-time mapping (schema-on-read) or SPL2 pipelines for ingest-time processing (schema-on-write).    How It Works: The Guided Workflow The guided workflow is designed to be intuitive and transparent:  Provide Sample Data: Upload or paste representative events.  Intelligent Analysis: The system clusters similar events and recommends CIM mappings.  Preview: You preview AI‑generated extractions and mappings.  Download and Deploy: Download generated artifacts for self-deployment to Splunk environment.  Why Auto-Schematization Matters This initiative is a core component of Splunk’s broader Cisco Data Fabric strategy, an architecture built to unify your data. By reducing admin toil and accelerating onboarding time from weeks to minutes, enabling your team to focus on high-value security operations rather than configuration maintenance.    Join the Alpha Cohort Want to accelerate your onboarding? Join the broader Guided Onboarding experience and reach out directly to our Splunk experts. Customer feedback will be instrumental in shaping the future of data management at Splunk,  as we continue to build a more intelligent and efficient data onboarding experience.    Oskar Patnaik   Product Management, Splunk Data Management  ... View more

Hello Splunk Community,    We're thrilled to share an exciting update that will help you manage your data more efficiently and drive even greater value from your Splunk deployments. As part of our ongoing commitment to streamline data onboarding and transformation, we're rolling out a fresh batch of prebuilt SPL2 pipeline templates for both the Splunk Edge Processor and Ingest Processor solutions. The new batch is now available on Splunk Cloud and coming soon to Splunk Enterprise.    What Are SPL2 Pipeline Templates SPL2 pipeline templates are ready-to-use building blocks designed to accelerate your data processing at the edge or during ingestion. These templates offer out-of-the-box logic for data transformation, volume reduction, and conversion of logs to metrics for a variety of popular source types.    Key Capabilities Reduce Data Volume: Minimize log size before indexing, saving storage and reducing costs, without sacrificing critical insights.  Quick Start: Deploy pipelines in minutes using templates for common data sources and use cases.  Customization: Templates are fully customizable to fit your unique organizational needs.  Compatibility: Designed to work with Splunk-supported Technology Add-ons (TAs), ensure compatibility with the Enterprise Security Content (ESCU), and Splunk Common Information Model (CIM), depending on the template type.    Types of Available Templates Our growing library currently includes 47 SPL2 pipeline templates, supporting a broad range of transformation and optimization scenarios. Key template types include:  Generic Templates: For quick data transformation needs across various sources.  Logs-to-Metrics Templates: Convert log data to metrics. Log size reduction for security & compliance: Reduce log volume while automatically maintaining CIM compliance and compatibility with Enterprise Security Content (ESCU), ensuring seamless integration with your downstream security monitoring tools    For a full list of templates and supported use cases, see the SPL2 Pipeline Templates Reference.    How to Use the Templates  Log in to your Edge Processor or Ingest Processor tenant.   Navigate to the Pipelines page.   Select the Templates tab to view all available SPL2 pipeline templates.  Select a template suited to your data source or use case and create a pipeline from it. Adjust the template to meet your organization's data requirements.  Apply the pipeline to your data flows and start realizing value immediately.    Explore a Practical Example Check out this step-by-step guide on reducing Palo Alto Networks log volume with SPL2 templates.  Best Practices & Further Resources  To maximize the benefits of SPL2 pipeline templates, explore our best practices guide.  Ready to streamline your Splunk data pipelines?  Visit docs.splunk.com, select your preferred SPL2 pipeline template, and start transforming your data today!     If you have questions or want to share feedback, please comment below or reach out to the me.    Happy Splunking!    Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more