Volume 343, Issue 3 · 6 articles
Splunk says OpenTelemetry is expanding beyond app instrumentation to messaging, networks and mainframes, citing its own contributions.
Splunk says OpenTelemetry is moving beyond cloud-native application instrumentation to connect enterprise messaging, networks, mainframes and heterogeneous infrastructure.
It highlights recent Splunk OpenTelemetry work, including general availability of IBM MQ support, new packaging, faster disk queuing and gNMI and YANG gRPC receivers.
Splunk argues the next stage of observability is preserving context across system boundaries rather than collecting more signals.
That context can then drive reliable human and automated action.
Splunk explains AI agent observability, built on traces, evals, cost and guardrail decisions to judge whether an agent was right.
Splunk says AI agent observability answers whether an agent was right, not just whether it ran.
An agent can pick the wrong tool or loop on the same search while every span reports success within its latency budget.
The practice rests on four signals: traces, evaluations, cost and guardrail decisions.
Splunk notes sampling is a common blind spot and says small purpose-built evaluator models can cost far less than LLM-as-judge, making it affordable to grade every interaction.
Splunk's threat research team simulates an offensive AI agent swarm in Splunk Attack Range to see how agentic attacks appear in telemetry.
A Splunk Threat Research Team member set out to see what an agentic swarm attack looks like in Splunk.
Using a modified Splunk Attack Range lab with a Windows domain controller, workstation and Linux NGINX server, he built an offensive swarm of five agents using Hermes.
He also tested a defensive agentic framework he has been developing.
The post maps each agent's role, objective and tasks and shows the resulting telemetry.
Splunk's security team publishes SOAR playbooks and custom functions for an automated end-to-end phishing response workflow.
Splunk says manual triage of phishing submissions is time-consuming, error-prone and delays containment.
Its Global Security Organization has published a full set of playbooks and custom functions for SOC teams.
The workflow uses the unified capabilities of Splunk Enterprise Security to automate phishing response end to end.
The playbooks are available from the Splunk SOAR community repository on GitHub or can be pulled directly into a SOAR instance.
Splunk introduces Metric Explorer, letting teams find metrics by entity, see their details and jump straight to charts or detectors.
Splunk has introduced Metric Explorer to simplify metric discovery in large environments where similar signals carry different names.
Teams can search by entity, such as a service or host, rather than guessing metric names.
The tool shows descriptions, units and data sources so teams understand what each metric measures.
Users can preview metrics over time and move directly into building a chart or detector.
Splunk adds IBM MQ queue and channel metrics via OpenTelemetry to Splunk Observability Cloud to catch slowdowns early.
Splunk says new IBM MQ metrics show queue depth, message age and channel health, helping teams catch slowdowns in payments and other critical workflows.
The MQ data flows through OpenTelemetry into Splunk Observability Cloud Infrastructure Monitoring.
This places queue health alongside the service metrics teams already monitor.
Splunk recommends alerting on sustained changes to important queues rather than brief spikes.