Diving Deep and Surfacing

Explore Splunk, a Cisco company, and how they are helping build a safer and more resilient digital world

In the modern enterprise, machine-generated data — which includes logs, sensor readings, and automated traces — has become the dominant form of data by volume. Roughly 80% to 90% of enterprise data growth is unstructured, much of which is captured from machines, sensors, and automated digital interactions.

Splunk, a Cisco company, is the premier platform for managing enterprise machine data. From application logs or event data being emitted by applications, to telemetry, trace information, or metrics, Splunk enables companies to unlock unprecedented value from that data.

As Splunk’s Americas Platform Field CTO, Keith McClellan guides organizations trying to manage the exponential growth of machine data whether they’re trying to drive cybersecurity, observability, or business outcomes. They face unprecedented challenges, and Splunk is there to help prepare them for a technological future rapidly accelerated by the next industrial engine, AI.

“When it comes to cybersecurity, the challenge may be to identify bad actors that have breached their network, or are endeavoring to exploit vulnerabilities in secure environments,” he said. “It may be observability, determining if you have sufficient resources allocated to a particular part of your application stack, or the ability to see bottlenecks, performance challenges, outages, and other necessities required for operating internet-scale applications.

“We also have customers using us for driving their business as well, particularly in segments like manufacturing retail where they have Industrial IoT devices.” Large manufacturers and other complex industrial firms are turning to Splunk for their 20 years of leadership in data platform technology.

“AI requires a common operating picture to be able to take effective action. The expression ‘garbage in, garbage out’ applies to data and AI even more than it did to previous generations of data and analytics technologies. So, we need a machine data repository that enables those AI power workflows.”

In McClellan’s view, the era of having purpose-built SaaS applications for 25 or 30 different business workflows is probably coming to an end. “Instead, we’re going to move to a more platform-centric approach where the AI agent and the context you write for that AI agent is going to drive use case outcome more than a user experience with the drag and drop or menu-driven approaches used today.”

As a Cisco company – the global leader in enterprise networking infrastructure controlling roughly 41% of the enterprise market – Splunk is now equipped to meet a wider range of customer challenges in the network observability space than ever before, and to move rapidly on AI. “We’ve been able to put an enormous number of R&D resources into building new foundational models around cybersecurity and time series data,” McClellan asserted.

AI is largely changing the landscape of UI and UX to be more generative and less prescriptive, replacing human capabilities that have been needed to drive workflows to completion. “AI needs different capabilities, largely around being able to operationalize that data in a very efficient way. Splunk has been a leader in that space for 20 years now.”

Both Splunk and Cisco are building a future where each product in the Cisco product suite no longer requires its own user interface. The Cisco AI Canvas is an AI-driven unified user experience that allows network analysts, security analysts, and executives to all work in a single user interface that’s far less specialized for particular workflows. “That’s going to completely change the way we’re thinking about this technology landscape and how we build systems going forward.”

Since the dawn of computing, we’ve been finding more efficient ways to give computers instructions, from punch cards to Python. Natural language processing allows us to give computers very sophisticated instructions to which they can respond and help flesh out the desired outcome, which AI can then execute.

McClellan anticipates that, from a mindset perspective, the primary skill experts will have in the future will look more like architecture and management than execution-based.

He posited that for an observability analyst or cybersecurity analyst writing queries and doing manual investigations, they may be managing a fleet of agents that do that work on their behalf and reviewing and providing feedback on that work, fine-tuning it instead of primarily doing the labor.

“What’s really good about that is that work tends to be more valuable to an organization than the actual typing on the keyboard ever was,” he stressed. The tremendous amount of machine data that’s been generated over the last 10 years have kept most analysts – whether cybersecurity, IT operations, or observability – in reactive mode, breaking up applications to solve Internet scalability challenges.

“We created a machine data corpus that could not be managed effectively_, so most organizations are ignoring things that they shouldn’t be because they simply can’t keep up even with the number of people that they have in their organization,” he explained, ruing that even if they could afford to hire enough trained people to do this work, those people don’t exist.

Cisco, at large, has a vision for a federated future, taking Splunk to customers’ data to overcome the fundamental physical limitations around shipping massive amounts of machine data all around the planet, not just from an electrical, physical infrastructure cost, but from the limitations of physics and the amount of data that can be moved over the wire in a given period of time.

“One of the most positive things that I think Cisco has driven Splunk to do is to move to a more of a federated first architecture. We have our first set of customers now that are starting to get their hands on our new machine data lake in Cisco Data Fabric.”

Announced in late 2025, the Cisco Data Fabric is a next-generation architecture designed to unify and analyze massive volumes of distributed machine data without requiring it to be moved to a central location. Powered by the Splunk platform, this fabric creates a “virtualized” view of data across edge, cloud, and on-premises environments, making it immediately available for AI model training and operational intelligence.

“We’re going to be able to drive much more positive outcomes with relatively small incremental investment around infrastructure while maintaining teams of experts that are going to be able to help us make sure that we’re driving to the right positive outcomes in information technology,” McClellan concluded.