Splunk rebuilds its platform around agents

Splunk has restructured its platform around agents to better serve the "agentic enterprise" era where AI systems generate vast amounts of telemetry. This strategic overhaul, rather than a routine product refresh, encompasses three key areas: observing and controlling AI systems, defending organizations at machine speed, and turning distributed machine data into actionable insights for people and agents.

At the core of this transformation is a new data platform that allows for analyzing information where it resides, rather than requiring customers to move everything into Splunk. This federated approach aims to reduce costs associated with ingesting and indexing large volumes of data, which could become increasingly critical as hundreds or thousands of agents continuously generate logs, events, and other telemetry.

The platform now includes a universal collector for metrics, events, logs, and traces, as well as real-time ingest processing and domain-specific AI models tailored for operational data. These models are designed to complement, rather than replace, advanced AI models, and will be available as self-hosted options for regulated businesses, government agencies, and other organizations with sensitive data.

Splunk is also partnering with Nvidia to enable AI processing in customers' own data centers, providing an option for organizations that cannot send sensitive operational data to external AI services. On the cloud side, a multiyear agreement with AWS will see both companies jointly develop agent-specific security products, integrating Splunk's data platform, security analytics, and investigation tools with AWS's cloud infrastructure and security signals.

Additionally, Splunk is enhancing its Agentic Security Operations Center Workforce with specialized agents for various security tasks, with customers deciding the level of autonomy for each agent.