Splunk .conf24: Consolidation and AI

I was recently at Splunk’s annual conference, .conf24, fresh from being acquired by CISCO. I’ve written about the acquisition and about my view on its potential impact in an evolving market. This post is a quick catch up on some of the cool things that were announced.

At first glance there are no big, exciting changes. But there were many small and important steps, consolidating the vision of digital resilience that drove last year’s event. While I’m not going to enumerate all the new capabilities and cool user stories, I wanted to again highlight the practicality of everything.

Terry Pratchett might have been a comedy fantasy author, but his stories often accurately mirror reality, and one of his main points was that edges are where things happen. Usually bad things. Edges are where the dark monsters creep into the world, whether Pratchett’s Discworld or your digital infrastructure. Splunk are experts at monitoring, controlling and exploring those edges, and there was plenty of excellent new capabilities in that area.

One of my favorites was a most unlikely pair of use cases from the Korean conglomerate LG. One use case was embedding a small language model inthe Splunk Edge Hub to allow it to perform image recognition in industrial settings with the need to deploy networks and services. As if that wasn’t cool enough, LG are also using Splunk to manage data from their appliances (did you know that they track whether people use new wash cycles on their machines?) as well as managing their vast, global network of suppliers and distributors. LG’s substantial AI team have built a collection of smart tools that sit over the data managed by Splunk to reduce waste and optimize logistics.

AI popped up in many places, from adding the Assistant to more Splunk and CISCO applications, but it went further. United Airlines is using Splunk to avoid the proliferation of AI platforms on their network to limit fragmentation and overbilling. Smart — using AI-enabled tech to keep tabs on AI usage. We also found out that paparazzi attack airline booking systems to find when their targets are traveling — no immediate consequences for the airline, but uncomfortable for the target.

For years I’ve been writing about the poor quality of many services on web and mobile, and now there are more and more tools that will help identify the sources of problems. As I’ve mentioned elsewhere, I find the use of the term “data” too vague as different people use it different ways. I’m happy that SIEM and Security vendors are now being more explicit about MELT data:

• Metrics that tell you why there is a problem
• Logs that tell you what the problem is
• Traces tell you where the problem is

Combining observability into all three parts in one tool makes it much easier for teams to debug issues on complex infrastructure. An expression I love from the world of monitoring is eliminating the swivel chair, meaning that the engineer can keep their eyes on one screen and not keep switching all the time. I think the next few years are going to bring us some exceptionally clever, integrated tools that will help those charged with maintaining our digital DNA stay tightly focused.