Splunk, CISCO and the evolution of IT

CISCO acquired Splunk in early in 2024. Many people think of the former as a maker of network switches and the latter as log analysis. While both of these impressions are still correct, they are very limited in scope. In its 50 years of existence CISCO has developed a vast panoply of products and services, ranging from advising nation states on network strategy to Webex. At half CISCO’s age, Splunk has grown its portfolio to include many capabilities focused on finding out what went wrong in enterprise infrastructure, why, who was responsible if it is security related, and how to remediate resulting issues. Both companies have substantial investments in applying AI in their domains.

Splunk has an incredibly dedicated community of users amongst the denizens of the world’s SOCs and NOCs¹. I’m not sure if anyone has a Splunk tattoo, but I would not be surprised². This group of people, almost all clad in the famous Splunk humorous t-shirts, converge on the annual .conf in Las Vegas for a heady mix of announcements, education and general chaos. Increasingly there is a track for senior management who need to be educated about the importance of maintaining their digital infrastructure — they stand out as a managed troupe wearing normal business attire.

This year the Splunk community approached .conf24 with trepidation — will CISCO have killed the vibe? Will the event be as grey as a typical CISCO router? Immediately on arrival it became apparent that this was very much still Splunk, with the familiar black-and-white branding enhanced with a generous bouquet of Pride pins, with just “a CISCO company” added below the established logo. It was very much Splunk as usual.

This message was further reinforced when CISCO CEO Chuck Robbins and former Splunk CEO, now Go-To-Market President at CISCO, Gary Steele, were on stage together. A nice piece of theatrics was them wearing t-shirts that read “better” and “together” under hoodies. While this particular slogan has a bitter taste for many of us Scots³, it was well suited to the occasion. Much effort was spent in reassuring the audience that the Splunk brand was being retained.

Honesty to the fore, the keynote also included a clear statement that this is an acquisition, but that it is not about taking over and crushing Splunk: it is very much a case of complimentary product sets. Delightfully to the irritation of Wall Street commentators, this is not about economies of scale and eliminating people. While that is not the CISCO way in any case, the level of investment after the deal is being increased to integrate critical components of the two portfolios. Clearly clients are screaming for these to be delivered as soon as possible if audience reactions are anything to go by.

.conf24 included plenty of information about how the companies are merging their observability tool suites, taking the best from both portfolios. Splunk is strong in cloud native app monitoring, for example, while CISCO has traditional application performance monitoring covered. Definitely better together, given that the vast majority of organisations have hybrid application portfolios. There is common Single Sign On (SSO). Many CISCO capabilities are being brought into the scope of Splunk, providing additional information to the already rich data feeds in that platform. The connection to AppDynamics means that performance information from applications software can be monitored alongside networks and ThousandEyes will provide additional information about events on networks to name the two most important.

There was also follow up on, and consistency with, the commitments made during .conf23. Perhaps the most important of these was availability of native support for Azure. Last year the agreement with Microsoft felt like something dropped in at the last possible minute, but this year there was detail and a plan. The audience was ecstatic.

However I saw a much larger picture emerging, aligned with my overall predictions for the evolution of IT and digital infrastructure. Read my next blog post to find out more about this hugely important transition.

¹ Security Operations Centers and Network Operations Centers.

² Maybe temporary tattoos as part of the merch package for .conf25?

³ “Better Together” was the slogan used by unionists opposing Scottish independence, largely based on the false claim that the only way for Scotland to remain in European Union was to remain part of the UK.