AI
What Splunk Actually Is
Splunk started as a log aggregation tool for IT ops teams. Point it at unstructured log files from operating systems, applications, and network devices, and it stitches them into a chronological stream. Security teams noticed they could ask the same data different questions: lateral movement, indicators of compromise, access patterns. The same platform now serves IT operations, security, observability, and DevOps.
“that’s really the crux of what Splunk does.” — Jason Conger
Building on Splunk as a Developer
Conger made the extensibility case directly to developers at Build. Query language, data ingestion, and visualizations are all open. Splunk is a major contributor to OpenTelemetry, so metrics, logs, and traces flow in without custom connectors. The platform’s development language is Python; anything that writes to stdout shows up as a Splunk event. Azure services (App Insights, Cosmos DB, Event Hub, Service Bus) connect through the same extension model. Splunkbase holds thousands of pre-built integrations, all downloadable and inspectable as source.
AI and Agentic Workflows, Plus Governance
Splunk has run machine learning for years, flagging outliers based on normal patterns for a given time of day. Generative AI shifts the model: instead of waiting for a query, Splunk surfaces trends and proposes fixes drawn from historical ticket data. Agentic AI then executes those fixes automatically. The flip side is governance. Cisco’s AI Defense layer tracks which models run in an environment, masks PII, and blocks prompts from exiting the company network.
“that the prompts are not letting IP outside the company.” — Jason Conger
Security Copilot Plugin and Getting Started
Splunk shipped a public preview plugin for Microsoft Security Copilot. The case for it: MSSPs manage multiple customers, each with different SIEM stacks. Natural language queries through Copilot let analysts cross-reference all of them without switching contexts. Getting started costs nothing. Pull splunk:latest from Docker, point it at a directory of text files, and you have working data ingestion in minutes. Splunkbase holds thousands of inspectable integrations. Lantern.splunk.com provides prescriptive use-case guides for Azure, security, and observability deployments.
Notable Quotes
If we can get to the data, we can do something with it. Wayne Brown · ▶ 2:35
that’s really the crux of what Splunk does. Jason Conger · ▶ 3:26
that the prompts are not letting IP outside the company. Jason Conger · ▶ 11:17
Key Takeaways
- Splunk ingests logs, metrics, and traces from any source and serves IT, security, and observability teams from one dataset.
- Generative AI and agentic features shift Splunk from reactive querying to proactive suggestions and automated remediation.
- A new public preview plugin connects Splunk to Microsoft Security Copilot; developers can start free via Docker or splunk.com.