Full-Stack Observability Office Hours: Ask the Experts October 22 nd 2026 | 11:00am – 12:00pm PT   As AI reshapes applications, infrastructure, and the way teams operate, having visibility across the entire technology stack has never been more important. Join Splunk experts for this four-part Full-Stack Observability series exploring how organizations can build resilient, high-performing digital experiences in the agentic era. From monitoring and governing AI agents to understanding end-user experiences, troubleshooting complex applications, and applying AI-driven SRE practices, you’ll see how Splunk Observability Cloud brings together insights across applications, infrastructure, networks, digital experiences, and business outcomes. Bring your observability questions to the experts. In this interactive office hours session, explore how full-stack observability can help teams move from reactive troubleshooting to proactive, AI-guided operations.   Register here ... View more

“AI + Observability Office Hours: Ask the Experts” October 6, 2026 | 11:00am – 12:00pm PT AI is transforming the applications that engineering teams manage and the methods used to operate them. Organizations building with LLMs and AI agents require new ways strategies to track performance and reliability while controlling costs.  Bring your AI and observability questions directly to Splunk experts in this interactive, AMA-style session and get practical guidance on your use cases, implementation challenges, AI workloads, agents, infrastructure, and Splunk’s expanding AI capabilities. Register here ... View more

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of monitoring are shifting. Today, the challenge isn't just knowing if a service is online, it is about verifying that your AI agents are behaving as expected, your infrastructure is cost-optimized, and your end users are receiving the high-quality digital experiences they demand. To help you navigate this transition, we are launching an exclusive four-part series, Full-Stack Observability for the AI Era, designed to equip you with the practical strategies needed to build trust, resilience, and visibility across your entire technology stack. Unified Visibility for the Agentic Era: Across four specialized sessions, we will explore how to correlate insights from networks, applications, and business outcomes into a single, accessible plane. By attending, you will learn how to transition from reactive troubleshooting to proactive, AI-guided remediation, ensuring your services remain performant and reliable as they scale. Expert-Led Practical Training: Whether you are an SRE, an engineer, or an IT leader, this series offers a blend of strategic discussions, technical demonstrations, and interactive workshops. You will gain hands-on experience using Splunk Observability Cloud to tackle complex microservice issues and learn how to automate detection to resolve incidents faster. Interactive Community Engagement: We are moving beyond theory to facilitate open, collaborative spaces, including a hands-on lab and dedicated office hours, where you can engage directly with experts. This is your opportunity to discuss how to break down operational silos, optimize performance, and align your observability strategy with your organization’s core business outcomes. Event Schedule and Highlights 1. Webinar: Optimize AI at Scale: From 'What Broke?' to 'Can I Trust the System? Date & Time: October 8th, 10:00am - 11:00am PT Focus: Learn to evaluate and govern agentic AI behavior while managing token consumption and costs. We will demonstrate how Splunk Observability Cloud and Cisco Cloud Control provide a unified view of your entire stack, correlating everything from network health to business impact. 👉 Register Here 2. Tech Talk: What’s New in Digital Experience Monitoring in Splunk Observability Cloud Date & Time: October 14th, 10:00am - 11:00am PT Focus: Discover how to track feature usage, visualize user journeys, and surface friction points. We will cover the latest enhancements in our digital experience capabilities and provide a sneak peek at our roadmap through early 2027 to help you catch issues before your users feel the impact. 👉 Register Here 3. Interactive Lab: Solve Problems Faster with Splunk Observability Free Edition Date & Time: October 15th, 10:00am - 11:30am PT Focus: Join us for a guided tour of Splunk Observability Cloud using a live Kubernetes cluster. You will set up an application and practice troubleshooting using APM and synthetic monitoring, leaving the session with your own Free Edition instance to continue experimenting. 👉 Register Here 4. Office Hours: Full-Stack Observability Office Hours: Ask the Experts Date & Time: October 22nd, 11:00am - 12:00pm PT Focus: A collaborative space to discuss the evolution of SRE. Bring your questions about integrating OpenTelemetry, refining root cause analysis, or aligning your monitoring strategy with business outcomes in hybrid and cloud-native environments. 👉 Register Here Never miss a new post. Check out this short guide on how to subscribe to the blog and get updates.  ... View more

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence is fundamentally changing how engineering teams build and operate modern digital services. As organizations increasingly adopt large language models (LLMs) and agentic AI, the demand for observability is reaching a critical inflection point. Teams are now tasked with a dual challenge: they must gain deep visibility into the complex behavior, cost, and reliability of AI applications, while simultaneously harnessing AI to simplify incident response and eliminate the manual toil of managing distributed, heterogeneous environments. Our new four-part event series, AI + Observability: AI Agents, LLMs, Apps, & Infrastructure, explores these two sides of the transformation, providing the technical framework and hands-on guidance necessary to succeed in the agentic era. What We’ll Cover Deep Visibility into AI Performance and Economics: Gain a comprehensive understanding of your AI ecosystem by learning to monitor the entire stack, from cloud infrastructure and retrieval pipelines to model prompts and tool calls. We will explore "Born Observable" strategies, showing you how to bake telemetry into AI applications from development to production, enabling precise control over token consumption, model latency, and overall AI spend. Intelligent Automation for SRE Workflows: Discover how to integrate conversational AI directly into your incident management lifecycle. By leveraging the AI Assistant within Splunk Observability Cloud, practitioners can query logs, charts, and traces using natural language, significantly accelerating root cause analysis across complex microservices and distributed infrastructure without needing to be deep-domain specialists. Practical Implementation and Hands-On Experience: Move beyond theory with a guided technical laboratory session designed to refine your troubleshooting skills. You will work within a live Kubernetes cluster to practice instrumenting and monitoring microservice applications, leaving the session with a permanent Free Edition instance to continue exploring advanced features like database monitoring and secure application protocols. Collaborative Technical Strategy Sessions: Engage in a focused forum for addressing your specific technical challenges and implementation strategies. Whether you are currently optimizing an existing LLM workflow or evaluating where to begin, this series facilitates direct interaction with technical specialists, allowing you to troubleshoot real-world implementation hurdles and align your monitoring strategy with your organization’s broader business goals. Event Schedule and Highlights 1. Webinar: Agent Observability with AWS and Splunk: Optimize AI Performance and Cost Date: September 22, 2026 | 10:00am – 11:00am PT Focus: Learn to manage the distributed complexity of AI applications. We will demonstrate how to simplify OpenTelemetry instrumentation using the Splunk Observability Studio and how to utilize runtime guardrails to prevent inaccurate or harmful AI outputs. 2. Tech Talk: AI Assistant in Observability Cloud: The Conversational Core of Your AI SRE Date: September 30, 2026 | 12:00pm – 1:00pm PT Focus: Explore the AI Assistant, the conversational core of your AI SRE strategy. See live demonstrations of how to generate charts, investigate health dependencies, and streamline incident response using plain-language queries. 3. Interactive Lab: Solve Problems Faster with Splunk Observability Free Edition Date: October 1, 2026 | 10:00am – 11:30am PT Focus: A high-intensity workshop for troubleshooting complex microservice applications. You will perform hands-on configuration of APM and synthetic monitoring, setting the foundation for your own production-grade observability implementation. 4. Strategy Session: AI + Observability Office Hours: Ask the Experts Date: October 6, 2026 | 11:00am – 12:00pm PT Focus: A dedicated session to discuss the practical realities of monitoring AI workloads. Bring your questions regarding architectural implementation, token usage patterns, and the integration of AI-guided remediation in hybrid environments. Register now to join these sessions and start building systems you can trust at scale. ... View more

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. Through a series of live, detailed demonstrations, we will showcase exactly how to leverage Metric Pipeline Management and Automated Archival to filter out noise and retain only the data that matters most to your business.   This on-demand session is designed for technical teams who want to see the tools in action. We will walk through complex use cases, demonstrating how to handle high-cardinality data and optimize retention without sacrificing observability. We will show you how to identify redundant metrics and how to apply transformations that significantly reduce your data footprint without losing the insights you rely on.     ... View more

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As organizations move from experimental AI prototypes to critical, agentic business workflows, the "black box" of agent behavior has become a primary operational challenge. Unpredictable token consumption, hidden infrastructure costs, and non-deterministic outputs can quickly erode customer trust and inflate cloud bills. By leveraging Splunk Agent Observability (powered by the acquisition of Galileo), engineering teams can finally gain the granular, end-to-end visibility required to correlate AI performance with business outcomes and maintain full control over their AI stack. Join our 4-part series of events designed to help you move beyond "vibes-based" development and into an era of evidence-based, cost-effective AI scaling: Event Roadmap: From Prototyping to Secure Production 1. [Webinar] Build Reliable, Cost-Effective Agents Date & Time: July 28, 2026 | 10:00 AM PT Focus: Runaway token costs, opaque LLM governance, error diagnostics, SLO tracking, and prompt-injection guardrails. If you are struggling with runaway token costs and opaque governance, this session is essential. We will demonstrate how to monitor the entire AI stack, from LLMs to underlying infrastructure, to diagnose failures and errors. You will learn how to track critical SLOs like latency and error rates, and implement custom SLM-powered guardrails to block sophisticated prompt-injection attacks and inaccurate or harmful responses before they impact your end-users. 👉 Register here 2. [Tech Talk] Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs Date & Time: August 06, 2026 | 10:00 AM PT Focus: AI stack economics, dimensional token visualization, live comparison "bake-offs," and action-to-token mapping. This technical deep dive explores how to master the economics of your AI stack by moving beyond theory. We will demonstrate how to visualize token consumption across multiple dimensions and conduct a live "bake-off" to compare token efficiency between different techniques. This session is designed for practitioners who need to map granular token consumption directly to specific agent actions and use precision scoring to validate task effectiveness and justify infrastructure investment. 👉 Register here 3. [Workshop] Build Better, Spend Less: A Hands-On Workshop on Token Efficiency Date & Time: August 27, 2026 | 10:00 AM PT Focus: 90-minute live instrumentation, Galileo integration, side-by-side efficiency trials, and traffic visibility with Luna models. In this 90-minute hands-on session, you will work directly with a multi-agent travel planner application to gain live experience in instrumenting workflows. You will learn the fastest path to integrating Galileo into your existing agentic workflows to gain immediate, high-fidelity visibility. By the end of the session, you will have the practical skills to conduct side-by-side efficiency comparisons and deploy Luna models to maintain 100% traffic visibility while drastically reducing token costs and latency. 👉 Register here 4. [Office Hours] Agent Observability & Tokenomics Date & Time: September 24, 2026 | 11:00 AM PT Focus: Interactive Q&A, token consumption forecasting, hardware metric correlation (GPUs/memory/fabric), and PII leak prevention. Scaling AI sustainably requires a data-driven approach to infrastructure. Join us for this interactive session where we address real-world deployment challenges, including how to forecast token consumption, correlate AI performance with hardware metrics—such as GPUs, memory, and network fabric—and implement proactive governance. We will discuss best practices for preventing PII leakage and runaway agent loops to ensure your AI remains safe and reliable in production. 👉 Register here   Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026  |  10:00AM PT / 06:00PM BST Register here   Take a deep dive into the technical advancements of ITSI 5.0 in this demo-focused session. We are pulling back the curtain to show you exactly how the new UX and modernized workflows function in real-world scenarios. This session is perfect for those who want to see ITSI in action and understand the mechanics behind our new Cisco integrations that enhance network observability. During this tech talk, we will demonstrate how to navigate the redesigned interface, perform rapid root-cause analysis, and utilize the enhanced AI-driven analytics to manage complex environments. You will leave this session with a clear understanding of how ITSI 5.0’s new features can be applied to your specific operational challenges to improve collaboration and reduce downtime. Explore the rest of our series by joining our upcoming events: Workshop: ITSI Event Analytics Workshop: From Signals to Service Insight July 16 th  2026 | 10:00am – 11:30am PT Office Hours: Splunk ITSI 5.0 Office Hours: Get Hands on with the Latest Release July 30 th  2026 | 11:00am PT / 7:00pm BST ... View more

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs Thursday, August 06, 2026  |  10:00AM–11:00AM PT Register here   Join us for a technical deep dive into the next generation of AI monitoring. In this session, we explore howSplunk Agent Observability (powered by the acquisition of Galileo)enables practitioners to gain unprecedented visibility into agent performance and cost. We will move beyond theory to demonstrate how to visualize token consumption across multiple dimensions and conduct a live "bake-off" to compare token efficiency between different techniques, using eval scores to validate task effectiveness. What you will learn: Granular Visibility: Mapping token consumption directly to specific agent actions and business outcomes. The Efficiency Bake-Off: A comparative analysis of agent techniques using Splunk Agent Observability to isolate performance bottlenecks. Eval-Driven Optimization: Using precision scoring to validate task effectiveness and justify infrastructure investment. Practitioner Workflow: A deep dive into troubleshooting non-deterministic behavior in production environments. Explore the rest of our series by joining our upcoming events: [Webinar] “Build Reliable, Cost-Effective Agents with Splunk Agent Observability” July 28 th , 2026 | 10:00am – 11:00am PT [Workshop] “Build Better, Spend Less: A Hands-On Workshop on Token Efficiency” August 27 th , 2026 | 10:00am – 11:30am PT [Office Hours] “Agent Observability & Tokenomics: Real World Questions, Use Cases, and Insights” September 24 th , 2026 | 11:00am – 12:00pm PT ... View more

Tech Talk Inside Event Intelligence: How ITSI Turns Network Alerts into Actionable Incidents   Correlating Signals Across Cisco Network Domains Today’s network environments span the campus, branch, data center, cloud, and the public internet. However, many teams still manage these domains through siloed tools such as Cisco Catalyst Center, Cisco ThousandEyes, and Cisco Nexus Dashboard. Each tool generates its own alerts, views, and version of the truth, resulting in excessive noise and the recurring question when issues arise: what actually matters and where should we start? What's in store With Splunk Platform and Splunk IT Service Intelligence (ITSI), organizations can unify these signals to deliver cross-domain event intelligence. Telemetry across network layers is consolidated, while ITSI correlates alerts, removes duplicates, enriches events with context, and prioritizes issues based on service impact. This helps teams transition from merely reacting to alerts to proactively assuring service health. In this On-Demand Tech talk, we’ll go deeper into how ITSI uses AI to group events, detect patterns, and surface likely root causes with summarized context across network domains, so teams can triage faster and act with confidence.   ... View more

  Tech Talk Network to App: Observability Unlocked   Today’s digital environments span applications, infrastructure, and networks, including the public internet and third-party services you don’t control. Yet many teams still operate with fragmented tools and siloed data. When issues arise, it often leads to long troubleshooting sessions and slow handoffs, with the fundamental question remaining: Is it the application, the infrastructure, or the network? Splunk Observability Cloud, combined with ThousandEyes, changes that. What's in store: Together, they provide end-to-end visibility across applications, infrastructure, and both owned and unowned networks. This enables teams to quickly understand what’s happening, pinpoint where the problem lies, and determine the next steps with AI-driven insights that highlight what matters most. In this On-Demand Tech talk, we’ll go deeper into how Splunk Observability Cloud and ThousandEyes surface insights across the stack, bringing together user experience, application performance, and network behavior into a single, usable view.   ... View more

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As observability data volumes continue to surge, managing metric storage efficiently has become a critical challenge for modern IT and DevOps teams. Rising ingestion and retention costs are pushing organizations to rethink how they collect, store, and analyze their data. In this series, we explore practical strategies for gaining control over already ingested metric data that contribute to high costs in Splunk Observability Cloud. By gaining a unified and transparent view of all metric data, including metrics and their dimensions, teams can finally bridge the gap between reported usage and their actual monitoring footprint. Splunk Metrics Cost Optimization features, such as Usage Analytics, Metric Pipeline Management, and Automated Archival, provide the visibility and control needed to understand cost drivers and to filter, transform, and route data more effectively. This approach transforms telemetry management from a reactive expense challenge into a proactive strategy, enabling organizations to scale their monitoring infrastructure efficiently while maintaining high performance and ensuring every dollar spent delivers clear, actionable business value. Join us for this series to learn how to reign in metrics costs and take control of your data. Event Roadmap: "From Insight to Action: Optimizing Telemetry Spend" [Webinar] Strategic Overview | June 18th, 10am PST Strategies for Splunk Observability Metrics Cost Optimization As observability data volumes surge, managing metric pipelines efficiently is a critical challenge. This webinar provides a high-level strategic overview of how to gain control over metric data contributing to rising observability costs and how to use Observability Cloud telemetry pipeline management features to rein in costs. Key topics include: Core pillars of cost optimization: Usage Analytics, Metric Pipeline Management, and Automated Archival Gaining a unified and transparent view of your metric footprint, including dimensions and usage patterns Identifying significant cost drivers and prioritizing efforts for maximum impact Transforming telemetry management into a proactive strategy for scalable monitoring infrastructure This session is the perfect starting point for anyone looking to control metrics costs and optimize their data. Register here [Tech Talk] Deep Dive & Demos | June 23rd, 10am PST From Insight to Action: Reducing Metrics Costs in Splunk Observability  This technical session offers a deep dive into Splunk Observability Cloud’s cost-optimization features. Through live demonstrations, learn how to leverage Metric Pipeline Management and Automated Archival to filter out noise and retain only the data that matters most. Highlights include: Handling high-cardinality data and optimizing retention without sacrificing observability Identifying redundant metrics and applying transformations to reduce data footprint Interactive Q&A with experts on technical nuances and infrastructure-specific challenges Ideal for technical teams seeking hands-on knowledge to optimize their telemetry pipelines. Register here [Office Hours] Open Q&A & Troubleshooting | June 30th, 11am PST Optimizing Your Metrics Telemetry to Reduce Observability Costs (AMA)  Bring your specific questions to this collaborative session for direct guidance from experts. Whether you’re struggling with cost drivers, interpreting Usage Analytics dashboards, or architecting pipelines for better performance, this open forum offers personalized demonstrations and real-time troubleshooting. Learn from peers, get feedback on your setup, and leave with a clearer path forward to manage your telemetry data effectively. Register here [Workshop] Hands-on Implementation | July 14th, 10am PST The Telemetry Lab: Practical Steps to Optimize Metric Costs  This interactive workshop moves beyond concepts into hands-on implementation within the Splunk Observability Cloud interface. You will: Configure Usage Analytics and set up Metric Pipeline Management rules Learn to filter, transform, and route data to reduce storage overhead while maintaining performance Practice setting up filters and archival policies in a safe environment By the end, you’ll have practical skills and configured settings to optimize your environment immediately, with confidence to maintain long-term cost visibility as your infrastructure grows. Register here Join us in this comprehensive series to transform your telemetry management approach, optimize costs, and unlock the full value of your observability data.   Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more

We are excited to announce the June release of Splunk IT Service Intelligence (ITSI) 5.0. This update introduces a modernized user experience, enhanced Cisco network observability, and powerful AI-driven analytics designed to help your team cut through alert noise and accelerate issue resolution. To help you get the most out of these new capabilities, we are hosting a comprehensive event series. Whether you are looking to simplify fragmented operations, reduce tool sprawl, or optimize your troubleshooting workflows, there is a session tailored for you. Explore the ITSI 5.0 Series 1. Webinar: Turn Alert Noise into Actionable Event Intelligence Thursday, June 25, 2026 | 10:00AM–11:00AM PT Join us for a high-level overview of how ITSI 5.0 unifies visibility across your applications, infrastructure, and networks. Learn how our latest AI-driven analytics group related issues into actionable incidents, allowing you to prioritize what truly impacts your business. Register here 2. Workshop: From Setup to Success – Network Events in ITSI 5.0 Thursday, July 16, 2026 | 10:00AM–11:30AM PT Ready for a hands-on experience? This interactive workshop moves beyond theory, providing direct access to the new ITSI 5.0 interface. Guided by our experts, you will learn to configure service monitoring and navigate the modernized UX to streamline your daily management tasks. Register here 3. Tech Talk: Unify Visibility, Reduce Alert Noise, and Focus on What Matters Tuesday, July 21, 2026 | 10:00AM PT / 06:00PM BST Take a deep dive into the technical advancements of 5.0. This demo-focused session pulls back the curtain on real-world scenarios, showing you how to perform rapid root-cause analysis and leverage new Cisco integrations to enhance network observability. Register here 4. Office Hours: Interactive Q&A and Best Practices Thursday, July 30, 2026 | 11AM PT / 7PM BST Have specific questions about the launch or your unique architecture? Join our open office hours to engage directly with our experts. Whether you need deployment guidance, a specific feature demo, or best practices for transitioning to the new UX, this is your time to get the clarity you need. Register here Join Us Don't miss the opportunity to see how ITSI 5.0 can transform your operations. Register for each or any upcoming sessions to start your journey toward more efficient service management and reduced downtime.   Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.  ... View more

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network Behavior May 28th, 2026 | 10:00am – 11:00am PT   In today’s digital environments, your applications, infrastructure, and network dependencies—including the public internet and third-party services, are constantly in flux. Yet, many teams are still operating with fragmented tools and siloed data. When an issue arises, the result is often the same: long war rooms, slow handoffs, and the age-old, frustrating question: "Is it the app, the infrastructure, or the network?" Join us for an upcoming  Tech Talk where we will demonstrate how to move beyond the blame game. What We Will Cover: In this session, we’ll go deeper into how Splunk Observability Cloud and ThousandEyes surface insights across the entire stack. We will show you how to bring together user experience, application performance, and network behavior into a single, usable view. Key Takeaways: End-to-End Visibility: See how to monitor both owned and unowned networks alongside your application data. Unified Insights: Learn how to break down data silos to identify the root cause faster. Actionable Intelligence: See how to turn complex telemetry into clear, actionable insights to reduce MTTR. Register here for the series or any specific event. ... View more

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid network environments, spanning the campus, branch, data center, cloud, and the public internet, the challenge isn't a lack of data; it’s a surplus of noise. Many teams are currently managing these domains through siloed tools like Cisco Catalyst Center, Cisco ThousandEyes, and Cisco Nexus Dashboard. While these tools provide deep insights, they often operate in isolation. Each generates its own alerts, its own view, and its own version of the truth. This leaves teams asking the same question every time an incident occurs: “What actually matters, and where do we start?” Technical Strategy: Turning Signals into Service Intelligence The goal of our May and June series is to show you how to break down these silos. By leveraging the Splunk Platform and Splunk IT Service Intelligence (ITSI), organizations can unify telemetry across network layers. ITSI acts as the intelligence layer that correlates alerts, removes duplicates, enriches events with context, and prioritizes issues based on actual service impact. It’s time to stop reacting to individual alerts and start proactively assuring your business services. Event Roadmap: "From Network Visibility to Service Intelligence" We have curated a series of sessions designed to help you master event intelligence. Whether you prefer a high-level overview or a hands-on technical deep dive, there is a session for you: [Webinar] Cut Through the Noise: Reduce Alerts and Prioritize What Matters with ITSI Date: May 27, 2026 | 10:00 am – 11:00 am PT Focus: Learn how to group related events, enrich them with context, and prioritize the issues that impact your critical services. [Tech Talk] Inside Event Intelligence: How ITSI Turns Network Alerts into Actionable Incidents Date: June 2, 2026 | 10:00 am – 11:00 am PT Focus: A deep dive into the AI behind ITSI. See how it detects patterns and surfaces likely root causes across network domains to slash your triage time. [Office Hours] From Alert Storms to Signal: Live Q&A on Reducing Noise Date: June 3, 2026 | 11:00 am – 12:00 pm PT Focus: An interactive session. Bring your current alerting challenges, specifically regarding noise, prioritization, or unclear ownership, and let’s troubleshoot them together. [Workshop] Build Service Views and Network Event Intelligence with ITSI Content Packs Date: June 10, 2026 | 10:00 am – 11:30 am PT Focus: A hands-on session. Learn how to use ITSI content packs to onboard data from Cisco network tools and build service views and prioritization logic from the ground up. Implementation: Ready to Get Started? Register here for these sessions and join the conversation in the community. Let’s move past the alert storms and build a more resilient, intelligent network together.   Want first dibs on fresh content? Follow this quick guide to subscribe and get updates instantly.   ... View more

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex applications, hybrid infrastructure, and networks that include the public internet and third-party services—areas you rely on but don't directly control. For many IT and DevOps teams, this complexity creates a major hurdle. When you are operating with fragmented tools and siloed data, troubleshooting becomes a cycle of long war rooms, slow handoffs, and the same frustrating question: Is it the app, the infrastructure, or the network? The Power of Unified Visibility It’s time to move beyond the guesswork. By combining Splunk Observability Cloud with Cisco ThousandEyes, you can finally bridge the visibility gap. This integration provides end-to-end visibility across your entire stack, applications, infrastructure, and both owned and unowned networks. With AI-driven insights, your team can quickly pinpoint exactly where a problem originates, understand its impact, and receive guided recommendations on what to do next. No more silos, no more guessing games. Join Our 4-Part Network Observability Series We are excited to invite you to our upcoming series, "Network to App: Observability Unlocked." Each session builds on the last, taking you from foundational visibility to real-world application. Join the entire series, or choose the events that best fit your needs: A Unified View: Splunk Observability & Cisco ThousandEyes Webinar May 19, 2026 10:00am – 11:00am PT  In this session, we’ll walk through how Splunk Observability Cloud and ThousandEyes give you a complete view across the stack, so you can quickly determine whether issues are coming from the application, infrastructure, or network and focus on what actually matters. Observability Simplified: Combining User Experience, Application Performance & Network Behavior Tech Talk May 28, 2026 10:00am – 11:00am PT In this session, we’ll go deeper into how Splunk Observability Cloud and ThousandEyes surface insights across the stack, bringing together user experience, application performance, and network behavior into a single, usable view. ThousandEyes Integration with Splunk Observability Cloud Workshop June 9, 2026 10:00am – 11:30am PT In this session, we’ll walk through how Splunk Observability Cloud and ThousandEyes give you a complete view across the stack, so you can quickly determine whether issues are coming from the application, infrastructure, or network and focus on what actually matters.   Ask the Experts: Troubleshooting Real-World Scenarios Office Hours June 11, 2026 11:00am – 12:00pm PT  Bring your real scenarios especially the ones where it’s unclear where the issue is coming from and we’ll walk through how to approach them using a unified view across the stack. Ready to get started?  Register for the series here and take the first step toward reclaiming your time and simplifying your operations. We look forward to seeing you there!   Keep the good stuff coming. Here’s how to subscribe to this blog — and stay in the loop on the topics that matter to you.   ... View more

Are you looking to gain deeper visibility into your database performance, whether you are a Splunk Observability Cloud user or transitioning from the AppDynamics ecosystem? We invite you to join our upcoming Community Office Hours: Database Monitoring in Splunk Observability Cloud on Thursday, April 16th, from 11:00 AM to 12:00 PM PST. This session is designed for SREs, ITOps teams, and anyone responsible for optimizing critical applications. We will dive into the power of Database Monitoring in Splunk Observability Cloud and show you how to move beyond siloed tools to achieve a truly unified view of your infrastructure. Why Attend? Whether you are already leveraging Splunk Observability Cloud or are familiar with the powerful insights of AppDynamics, this session will demonstrate how to: Identify Bottlenecks Faster: Pinpoint slow or inefficient queries before they impact your users. Correlate Data: Bridge the gap between application performance and database activity for rapid root cause analysis. Accelerate Remediation: Leverage AI-powered recommendations to resolve issues with confidence. Experience Unified Observability: See how Splunk is evolving to provide a seamless monitoring experience that brings together the best of our observability platforms. What to Expect Our technical experts will be on hand to share best practices, demonstrate new capabilities, and answer your most pressing questions. This is an open AMA (Ask Me Anything) format, so come prepared with your specific challenges! Sample questions we can cover: How do I proactively find and resolve slow queries? What is the best way to connect database performance with application and infrastructure metrics? How can I troubleshoot query performance and identify the root cause effectively? Are there specific tips for query optimization? How do I configure telemetry collection in Splunk Observability Cloud? For our AppDynamics users: How does this experience compare to what you are used to, and how are databases instrumented in this environment? How to Join We want to ensure we address your specific needs, so please submit your questions in advance when you register. Pre-submitted questions will be prioritized, though we will also open the floor for live Q&A during the session. Date: Thursday, April 16th Time: 11:00 AM – 12:00 PM PST Join the Conversation: You can also connect with the community in our #office-hours Slack channel We look forward to connecting with you and helping you take your database monitoring strategy to the next level. Register here! ... View more

Modern digital environments are more complex than ever, spanning cloud-native applications, infrastructure, networks, and end-user experiences. Teams are often left navigating fragmented tools and data silos, slowing down troubleshooting and increasing operational risk. Splunk Unified Observability brings everything together into a single, AI-powered experience, combining application performance monitoring (APM), infrastructure monitoring, and network visibility in one cohesive platform. The result? Faster mean-time-to-resolution (MTTR), improved collaboration across teams, and deeper insights across your entire digital estate. To help you explore this approach in depth, we’re excited to invite you to our Unified Observability March Series, featuring a Workshop, Webinar, Tech Talk, and Community Office Hours. What Is Unified Observability from Splunk? Splunk Unified Observability consolidates multiple observability pillars into a single experience, powered by AI, to eliminate data silos and accelerate troubleshooting. Whether you’re an existing Splunk customer or just getting started, unified observability helps you move from isolated signals to actionable insights across applications, infrastructure, networks, and digital experiences. About This Series This series offers a deep dive into the core components of the Splunk marketecture, including Digital Experience Monitoring, Application Performance Monitoring, Infrastructure Monitoring, and AI-powered troubleshooting. Each session provides focused technical insights while demonstrating how these capabilities work together under a unified strategy to deliver seamless, end-to-end observability. 📅 Session 1: Workshop Digital Experience Monitoring 🗓 March 12, 2026 | 10:00 AM – 11:30 AM PT In this hands-on workshop, explore how Digital Experience Monitoring (DEM) helps you understand how real users experience your applications. Learn how to correlate frontend performance, user journeys, and backend services to identify and resolve issues before they impact customers. What you’ll gain: Practical guidance on monitoring real user experiences Visibility into frontend performance and user behavior Techniques to correlate user experience with application and infrastructure health 📅 Session 2: Webinar Faster Troubleshooting & Root Cause Analysis in Observability Cloud with Agentic AI 🗓 March 17, 2026 | 10:00 AM – 11:00 AM PT Troubleshooting across complex environments doesn’t have to be manual or time-consuming. In this webinar, learn how agentic AI in Splunk Observability Cloud accelerates root cause analysis by correlating signals across services, infrastructure, and networks. In this session, you will learn how to: Reduce MTTR with AI-driven insights and guided investigations Automatically surface probable root causes across domains Move from detection to resolution faster with explainable AI assistance 📅 Session 3: Office Hours Splunk Application Performance & Infrastructure Monitoring 🗓 March 26, 2026 | 11:00 AM – 12:00 PM PT Join this interactive Community Office Hours session to engage directly with Splunk experts. Ask questions, share challenges, and get practical guidance on Application Performance Monitoring (APM) and Infrastructure Monitoring within the unified observability experience. Topics you can explore include: Best practices for monitoring modern, distributed applications Correlating application performance with infrastructure health Getting more value from Splunk Observability Cloud in real-world environments 📅 Session 4: Tech Talk Intro to Digital Experience Analytics: Connecting User Behavior with Observability 🗓 March 31, 2026 | 1:00 PM – 2:00 PM PT Understanding user behavior is critical to delivering great digital experiences. In this Tech Talk, you’ll learn how Digital Experience Analytics connects user behavior with observability data to provide actionable insights into application performance and customer journeys. Key takeaways: How to analyze user behavior alongside performance metrics Identify friction points impacting user experience Connect frontend insights with backend observability for faster resolution ✅ Why Attend the Unified Observability Series? By joining this March series, you’ll: Learn how Splunk’s observability pillars work together in a single experience Gain hands-on and technical insights you can apply immediately Reduce troubleshooting time and improve operational efficiency Engage directly with Splunk experts and the community 👉 Register for one or all sessions and see how Unified Observability helps you move faster, from user experience to root cause. We look forward to connecting with you throughout March in the Splunk Community! If you’re not subscribed, you’re probably missing something good. Fix that!  ... View more

  Tech Talk  Intro to Digital Experience Analytics: Connecting User Behavior with Observability Delivering seamless digital experiences requires more than just tracking latency and load times. Product, Engineering, and UX teams need a holistic view that combines technical observability with a deep understanding of user behavior. Discover how Digital Experience Analytics in Splunk Observability Cloud brings together behavioral and observability data to empower your teams. What's in store: Unify Data for Complete Visibility Combine traditional observability signals (latency, JavaScript errors, load times) with user behavior insights. Get a comprehensive view of your applications’ performance and user journeys. Track User Behavior and Sentiment Monitor feature adoption, friction points, and the reasons behind drop-offs or conversions. Understand how real users interact with your digital products. Prioritize Engineering Work Effectively Enable engineering teams to focus on issues that truly impact users. Use actionable data to streamline troubleshooting and development. Diagnose and Resolve Experience Issues Faster Empower Product and UX teams to identify and fix digital experience issues quickly. Benefit from out-of-the-box correlation between observability and behavioral data. See a Deep-Dive Demo Watch Digital Experience Analytics in action and learn how minimal setup can start delivering results. Watch the full recording here: ... View more

Observability for AI Series: Monitor, Troubleshoot, and Optimize Your AI with Splunk AI is rapidly becoming foundational to modern applications powering everything from software development and customer support to business-critical workflows. As teams adopt large language models (LLMs), AI agents, and new AI infrastructure components like vector databases and frameworks, observability must evolve to keep pace. To help you navigate this complexity, we’re excited to invite you to our Observability for AI series, a three-part campaign featuring a Webinar, Tech Talk, and Community Office Hours. Each session is designed to help you gain deeper visibility, reduce operational toil, and ensure your AI-driven systems remain reliable, safe, and cost-effective. 📅 Session 1: Webinar Monitor Your LLMs, AI Agents, and AI Infrastructure with Splunk Observability for AI 🕙 March 5, 2026 | 10:00 AM PT AI’s non-deterministic and generative nature can introduce “slop”, outputs that are inaccurate, low-quality, or even harmful. As AI systems become more autonomous and complex, ensuring they operate efficiently and align with business goals has never been more critical. In this webinar, you’ll see how Splunk’s agentic observability delivers end-to-end visibility across the entire AI stack, from LLMs and agents to the underlying infrastructure. Learn how AI Infrastructure Monitoring and AI Agent Monitoring, integrated with Cisco AI Defense, help teams proactively identify risks and optimize performance. In this session, you will learn how to: Leverage agentic, AI-powered observability to connect business context with telemetry Monitor the quality, accuracy, security, and cost of LLM and agentic applications Detect AI risks in real time, including PII leakage, prompt injection, and policy violations Track and optimize resource consumption such as token usage, GPU and memory utilization, estimated token costs, and cost per request 📅 Session 2: Tech Talk Conquer Complexity and Accelerate Resolution with Splunk Observability Cloud’s Multi-Agent Experience 🕐 Tuesday, March 10, 2026 | 1:00 PM PT / 4:00 PM ET Traditional incident response often involves reactive troubleshooting across multiple tools and dashboards, slowing down resolution and increasing operational overhead. In this Tech Talk, you’ll learn how Splunk’s multi-agent troubleshooting experience helps teams dramatically reduce mean time to identify (MTTI) and mean time to resolution (MTTR). Discover how guided, explainable insights enable teams of all skill levels to pinpoint root causes faster and remediate issues with confidence. In this session, you will learn how to: Reduce MTTR from hours to minutes with guided root cause analysis and remediation Prioritize alerts and troubleshooting efforts by business impact Remove knowledge barriers so teams can onboard faster and deliver value sooner 📅 Session 3: Community Office Hours Splunk Community Office Hours: Learn More About AI-Powered Observability and Observability for AI 🕚 March 19, 2026 | 11:00 AM PT Couldn’t connect with us at Cisco Live EMEA? Join our Splunk Community Office Hours for an interactive session with Splunk experts. This is your opportunity to ask questions, get practical guidance, and dive deeper into AI-powered observability and Observability for AI capabilities. Whether you’re exploring AI-driven troubleshooting and remediation or looking to monitor the quality, security, and cost of your LLM and agentic applications, this session is designed for open discussion and hands-on learning. You can ask questions like: How can I leverage Splunk’s AI capabilities to proactively detect anomalies and remediate incidents? What are common challenges when implementing AI for observability at scale? How can I track and optimize cost and resource usage across AI apps and services? Pre-submitted questions will be prioritized, followed by live Q&A with participants. ✅ Why Attend the Observability for AI Series? By attending these sessions, you’ll gain: Practical guidance for monitoring and optimizing AI-driven systems A deeper understanding of AI risks, costs, and operational trade-offs Direct access to Splunk experts and the broader community 👉 Register for one or all sessions and take the next step in your Observability for AI journey. We look forward to connecting with you in the Splunk Community! ... View more

  Tech Talk  AI Agents in Observability Cloud  On Tuesday, March 10th, 2026, Splunk invites you to an engaging Tech Talk focused on AI Agents in Observability Cloud. This session is designed for any technical practitioner looking for valuable and insightful deep dives. Transform reactive incident response with Splunk’s troubleshooting agents, designed to drastically reduce mean time to identify and resolve issues. This session demonstrates how a multi-agent approach empowers teams of all skill levels to pinpoint root causes, prioritize issues by business impact, and prevent future outages. What’s in Store: Reduce MTTR from hours to minutes by pinpointing root causes and executing a guided remediation plan to prevent future outages     Prioritize alerts and troubleshooting efforts in-context and by radius of business impact using explainable, trusted information with evidence-backed summaries and steps to resolution    Remove knowledge barriers to ensure everyone on your team, regardless of tenure or technical acumen, can more quickly onboard and add value  Watch the full recording here: ... View more

[Watch On-Demand] This thread for the Community Office Hours session on AI-Powered Observability and Observability for AI on March 19th 2026 | 11:00am - 12:00pm PT Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? How can I leverage Splunk’s AI capabilities to proactively detect anomalies and remediate incidents? What are some common challenges or limitations when implementing AI for observability at scale? How can I track and optimize cost and resource usage across my AI apps and services? Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you! ... View more

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world of modern retail, the technology powering your stores is just as critical as the products on your shelves. But as environments become more distributed and customer expectations rise, IT Operations teams are facing a perfect storm of complexity. Between siloed tools, overwhelming data volumes, and the constant pressure to reduce costs, maintaining resilience is harder than ever. When blind spots exist, detection slows down, and downtime creeps up—directly impacting the customer experience. It’s time to move from reactive troubleshooting to proactive service assurance. See Splunk in Action at the Cisco Store We invite you to join us for an exclusive Splunk Demo Day: Transforming IT Operations with Splunk. In this session, we aren't just talking about theory; we are showing you the reality. We will take you inside the IT operations of the Cisco Store to demonstrate how the Splunk Platform delivers powerful, unified monitoring in a real-world retail environment. What You Will Learn Through live, in-product demonstrations, our experts will show you how to tackle the unique challenges of distributed retail systems. You will discover how to: Centralize & Normalize Data at Scale: Say goodbye to data silos. Learn how to seamlessly ingest and unify logs, metrics, and event data from store systems, network devices, and cloud services for fast, reliable analysis. Accelerate Incident Detection: Stop searching for needles in haystacks. We will show you how to leverage real-time search and correlation across your entire tech stack to pinpoint root causes using intuitive dashboards purpose-built for IT Ops. Optimize Data Pipelines: Balance performance with cost. Discover how to control data retention, power forensic investigations, and meet compliance requirements without blowing your infrastructure budget. Who Should Attend? Whether you oversee IT Operations across a massive distributed footprint or manage operational intelligence for a single location, this webinar is designed for you. If you are looking to reduce downtime, optimize resources, and ensure a seamless customer experience, you won't want to miss this. Meet Our Speakers Kyle Prins: Senior Staff Technical Marketing Engineer, Splunk Brandon Benke: Director, Product Marketing, Splunk Register Today Don’t let blind spots slow you down. Experience the Splunk Platform in action and discover how to unlock unified visibility and unstoppable service uptime for your organization.   If you’re not subscribed, you’re probably missing something good. Fix that!  ... View more

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to find brilliant, practical solutions to the real-world challenges our users face. This month, we’re focusing on two tricky scenarios that can stump even seasoned Splunk pros, both involving the art of choosing the right command for the job. Let's explore these common SPL (Search Processing Language) puzzles and the elegant community-sourced solutions that cracked them. Challenge #1: The Mystery of the Duplicating Lookup Data A user bigchungusfan55 was building an essential asset and identity lookup for Splunk ES. They created a daily report to keep it updated, but soon noticed something bizarre: fields with multiple values were duplicating and mashing together. For example, a user in the "Member" and "Executive" categories would look correct on Day 1, but on Day 2, their categories would become "Member, Executive, MemberExecutive," growing exponentially each day. The usual de-duplication commands didn't work, making the mystery even more frustrating. The Community Solution: It’s Not What You Save, but How You Save It A community expert and SplunkTrust member bowesmana revealed that the issue wasn't the admin's logic, but a subtle detail in how Splunk saves lookup files. Think of it this way: by default, Splunk saves a list of values like "Hiking" and "Biking" by writing them on a single line of paper as "Hiking Biking." When you read that paper back, you can't tell they were originally two separate items. The solution was to tell Splunk to save the file in a special format that preserves multi-value fields. This is like using a container with built-in dividers to keep "Hiking" and "Biking" in their own compartments. When the report reads the file the next day, it understands they are distinct values, and de-duplication works perfectly. The fix was as simple as adding a specific instruction to the outputlookup command, telling it to use this multi-value-aware format. Key Takeaway: When working with lookups containing lists or multiple values, the default save format can cause chaos. Always specify a format that preserves the data's structure to ensure your updates work as expected. Challenge #2: The Common Pitfall of Calculating Percentages Another user, Ombessam wanted to perform a data quality check: for every field in their data, what percentage of values were empty? Their plan was logical: first, calculate the nullCount for each field, and second, get the total number of events. To combine these, they used the appendcols command to "staple" the total count onto their results. But it didn't work. The total was only added to the very first row of their table, making it impossible to calculate the percentage for any other field. The Community Solution: The Magic of eventstats An expert and a SplunkTrust member richgalloway pointed out a classic Splunk lesson: appendcols is almost always the wrong tool for this job. Instead, they recommended eventstats. Think of eventstats as a magical assistant. It can perform a summary calculation (like a total or an average) on your entire dataset, but instead of creating a separate report, it whispers the result back and adds it as a new column to every single row of your current table. With eventstats, the user's table was instantly enriched. Every row now had both its individual nullCount and the overall total, making the final percentage calculation a piece of cake. It solved the problem in one efficient step, without needing to stitch separate searches together. Key Takeaway: When you need to use a summary value (like a total) in a calculation for every row, eventstats is your best friend. It enriches your data in place, whereas appendcols is better suited for joining completely unrelated reports. Join the Conversation! These two solutions are perfect examples of how a small piece of expert advice can solve a massive headache, thanks to bowesmana and richgalloway. The Splunk Community is the best place to find these nuggets of wisdom. We encourage you to jump in, ask your toughest questions, and share your own solutions! —---------------------------------------------------------------------------------------------------------------------------- Get featured! Would you like to feature more solutions like this? Reach out @Anam Siddique on Slack in our Splunk Community Slack workspace to highlight your question, answer, or tip in an upcoming Community Content post! 💡 Our contributors who are highlighted for providing a solution will be given a $25 Cisco Store gift card for their contributions Here are some great ways to get involved and expand your Splunk expertise: Splunk Answers, Community Blogs, Splunk Champions, Community Slack, UserGroups, and Badges Program! Role-Based Learning Paths: Tailored to help you master various aspects of the Splunk Data Platform and enhance your skills. Splunk Training & Certifications: A fantastic place to connect with like-minded individuals and access top-notch educational content. Dive into these resources today and make the most of your Splunk journey! ... View more

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community such a vibrant and helpful place: you! Your dedication to sharing knowledge and supporting fellow users is what drives us forward. This month, we saw incredible engagement around our Content Calendar and SME Day, and we want to give a special shoutout to the members who made it all possible. Community Calendar Contributors Our monthly Community Content Calendar is where we feature the most insightful and practical solutions to real-world problems. This October, our post focused on solving common Splunk headaches, like fixing incorrect timestamps and demystifying license warnings. The brilliant answers featured in this post came from two of our fantastic community members. Please join us in giving a huge round of applause to: davidoff96 thahir Your clear explanations and expert advice turned frustrating problems into valuable learning opportunities for everyone. Thank you for sharing your knowledge and helping make Splunk easier for users everywhere! SME Day Expert Spotlight SME (Subject Matter Expert) Day is a special event where one of our top experts dedicates their time to answering questions on a focused, high-impact topic. This month, we were incredibly fortunate to have Young So lead the discussion on the critical topic of "Building Reliable Asset and Identity Frameworks in Splunk ES" [insert article link once live] This is a cornerstone of any mature security posture, and having a solid A&I framework is essential for getting the most out of Enterprise Security. Young So’s expertise helped demystify this complex area, providing clear guidance and actionable advice for everyone who participated. Thank you, Young So, for lending us your time and invaluable experience! While we're highlighting these amazing individuals, we want to extend our gratitude to every single person who participated in the community this month. Whether you asked a question, offered an upvote, or shared your own solution, you are a vital part of what makes this ecosystem thrive. So, one last round of applause for davidoff96, thahir, and Young So for their outstanding contributions in October! Until next time! ... View more

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the true heart of the Splunk Community: you! Your willingness to share knowledge, answer questions, and support fellow users is what makes this community the best in the business. This September, we saw incredible engagement around our Content Calendar and our SME (Subject Matter Expert) Day. Today, we want to shine a spotlight on a few individuals who went above and beyond. September Content Calendar Heroes Our monthly Content Calendar is where we feature the most insightful, practical, and well-explained solutions to real-world problems faced by users. This month, we extend a huge thank you to the following members for providing the brilliant answers that were highlighted: mrkhan48 (Pathfinder): Thank you, mrkhan48, for your excellent contribution! As a Pathfinder, you are lighting the way for others by helping them navigate complex Splunk challenges. Your solution was clear, effective, and a perfect example of community-driven problem-solving. thahir (Communicator): We also want to recognize thahir for their fantastic answer! Your Communicator rank is well-deserved, as you excel at breaking down technical topics into easy-to-understand solutions. Thank you for sharing your expertise with the community! The knowledge shared by mrkhan48 and thahir helps turn difficult problems into valuable learning opportunities for everyone. A Special Thanks to Our SME Day Expert SME Day is a special event where one of our top experts dedicates their time to answering questions on a specific topic, providing focused and deep expertise. This September, we were honored to have an industry leader step up to the plate: hettervik (Builder & Splunk MVP): A massive thank you to Splunk MVP hettervik for serving as our Subject Matter Expert! As a Builder, you are known for creating amazing things with Splunk, and your willingness to share that deep knowledge with the community is invaluable. Your dedication during SME Day helped countless users get the expert answers they needed. You Make the Community What It Is While we're highlighting these three individuals, we want to extend our gratitude to every single person who participated in the community this month. Whether you asked a question, offered an upvote, or shared your own solution, you are a vital part of what makes this ecosystem thrive. Inspired to see your name here one day? Jump into the forums, share what you know, and you could be featured in a future spotlight! Thank you once again to mrkhan48, thahir, and hettervik for your outstanding contributions in September. ... View more