(Michael Vi/Shutterstock)
This week at Splunk’s .Conf25 gathering in Boston, the company and its parent Cisco unveiled the Cisco Data Fabric, a new architecture designed to turn machine data into usable fuel for AI. Built on the Splunk platform, the system is designed to make it easier and less costly for enterprises to gather, manage and analyze the enormous streams of data that flow from servers, networks, applications and edge devices. When harnessed effectively, these data streams can become the raw material for everything from training custom AI models to orchestrating agentic workflows.
Company executives framed the announcement as the next step in Splunk’s evolution. Jeetu Patel, Cisco’s president and chief product officer, called machine data a “gold mine” that has historically been too cumbersome and expensive to activate for AI. Patel said the new fabric extends Splunk’s original role in cloud data analytics into the AI era, giving enterprises a way to build models with their own proprietary machine data.
Breaking Down the Features
At its launch, Cisco and Splunk outlined several new components of the Data Fabric that show how the architecture is meant to work in practice. Among the features highlighted at the launch were:
Time Series Foundation Model (TSFM): Powers advanced pattern analysis and temporal
reasoning on time series data, enabling advanced anomaly detection, forecasting, and
automated root cause analysis across the Cisco Data Fabric. It drives proactive operations,
accelerates incident response, and turns machine data into actionable intelligence.
Unified, Intelligent Data Foundation: Seamlessly transforms data across edge, cloud, and
on-premises, including SecOps, ITOps, DevOps, and NetOps, into real-time, actionable insights
while optimizing for cost and efficiency.
Borderless Real-Time Search and Analysis: Instantly search and analyze data wherever it resides,
federating across sources like Amazon S3, Apache Iceberg, Delta Lake (with Spark), Snowflake,
and Microsoft Azure, while intelligently routing data to the most appropriate storage or analytic
engine for the workload.
Fueling AI Innovation: Unique capabilities such as Splunk Machine Data Lake, which will provide
a persistent, AI-ready foundation for both model training and enterprise analytics. Together with
the Splunk AI Toolkit and MCP server, these innovations help to transform machine data into a
fuel source for advanced AI capabilities.
AI-Native at Every Step: Delivers built-in AI at every stage of the data lifecycle – from onboarding
and continuous monitoring to self-healing operations – driving unprecedented productivity,
agility, and innovation.
Flexible, Open Architecture: Adapts to any environment with open standards, plug-and-play
integrations, and self-service tools – empowering innovation without limitations.
Mangesh Pimpalkhare, Senior VP and GM of Platform, Splunk
AIwire spoke with Mangesh Pimpalkhare, senior VP and general manager of platform for Splunk, about the Cisco Data Fabric. “The strategic picture is ultimately to help enterprises with a unified operational solution specifically for the AI era,” he said. This means unifying how enterprises tackle operational challenges across security, IT, DevOps, and network teams. These jobs, Pimpalkhare said, have become nearly impossible to manage with traditional dashboards and queries. The complexity of enterprises, along with the surge of AI tools and machine data, makes problem-solving reactive and slow. The vision behind the Data Fabric is to flip that model, using AI trained on machine data to spot issues early and assist human operators in resolving them faster.
What makes this different from earlier Splunk architectures, he explained, is that it is AI-first rather than human-first. Prior iterations focused on making human workflows more efficient by reducing the number of queries or translating them into natural language. In contrast, the Data Fabric envisions AI agents that proactively monitor enterprise systems, fine-tuned to the unique patterns of each industry or organization, and capable of detecting anomalies before they become problems. This is what Cisco means when it talks about “activating” machine data: moving from a passive store of information to a system where data continuously trains models that monitor and respond in real time.
At the heart of this approach is the Splunk Machine Data Lake. Unlike traditional data lakes that consolidate everything into a single physical repository, this is a distributed lake that catalogs and connects machine data where it lives. Some of that data might sit with Splunk or Cisco, but much of it lives in customer repositories or in systems like Snowflake and ServiceNow. By federating queries and building a knowledge graph across these sources, Splunk aims to give both human operators and AI agents the ability to pull together desired data on demand.
Enabling this is the Splunk Model Context Protocol (MCP) Server, which Pimpalkhare described as the natural language interface for Splunk’s capabilities. Much like APIs in the past, MCP provides a standardized way for external agents and applications to call on Splunk functions. This not only powers Splunk’s own agentic AI products but also allows outside AI systems to tap into the Splunk platform using natural language prompts.
Looking ahead, Pimpalkhare sees the Data Fabric evolving in three important directions. First, the adoption of open standards and interfaces like Apache Iceberg will be critical for interoperability across the industry. Second, he expects the rise of domain-specific models rather than huge general purpose foundation models. Finally, he stressed the need for customer fine-tuning: while the Data Fabric provides the toolkit, enterprises will need to adapt it to their unique needs in fields like finance, retail, and media.
For Pimpalkhare, the Data Fabric itself is the most exciting piece of Cisco and Splunk’s announcements this week. “If we were to focus all our energy on one thing, it’s really the Data Fabric, because it drives the platform effect for all the observability use cases, for all the security use cases, and just creates a natural flywheel,” he said.
A Foundation Model for Time Series Data
One of the most interesting features of the Cisco Data Fabric is its Time Series Foundation Model. Machine data often comes in the form of time series, with metrics collected every minute or every second, sometimes stretching across months or years. Building a foundation model to interpret these sequences is significant, because it allows AI to capture the rhythms and correlations of complex systems, much like how large language models capture the structure of human text. For an inside look at the Time Series Foundation Model, AIwire sat down with Splunk VP of AI Hao Yang to explain.
Though LLMs have taken the world by storm, they are not always the answer for every use case. Machine data needs a different approach, Yang says. LLMs can answer IT-related questions because they have been trained with log-like data from the internet, but they lack the intrinsic patterns, or the real, lived behavior of IT and security infrastructure systems over time. “That’s why we think that it is important for us to have a really domain-specific model that understands how these different systems work, and especially, how these systems work together,” Yang said.
(spainter_vfx/Shutterstock)
The Time Series Foundation Model, to be released later this year, is meant to capture those intrinsic patterns, focusing on correlations across systems and time. Instead of predicting the next word in a sentence, the model is learning to anticipate the next point in a sequence of system readings. By breaking the flood of time series data into manageable segments, the model produces embeddings that capture the underlying patterns. Just as a GPT predicts the most likely next token, Splunk’s model learns to forecast the next segment of operational data.
But working with time series brings unique issues. Unlike human language, where the same words and rules consistently reappear, machine data can be both highly repetitive and highly volatile. Yang was cautious not to reveal too much detail about the model’s architecture before its official release, but he did outline the scope of the challenges his team faced in building it. LLMs are usually trained on relatively stable and well-defined data like Wikipedia and books, but machine data has no canonical reference set. System metrics vary wildly across workloads, and patterns change constantly. “Machines are inventing new patterns all the time,” Yang noted, making it far harder to pin down what counts as the “language” of time series data. For example, a model trained on temperature sensors will see a very different set of patterns than one trained on network traffic, and reconciling that diversity without producing erratic predictions can be difficult.
Hao Yang, VP of AI at Splunk
Another obstacle is the lack of labeled datasets. Language models can draw on curated sources of knowledge, but a time series model must sift through billions of raw, unlabeled signals. Yang noted that the challenges of variety and scale required his team to think carefully about data preparation and about what kinds of architectures would be best suited for these problems.
Yang described the team’s approach as hierarchical: “It’s almost like a hierarchical model, where you learn some of the local structures, and then you learn some of these local structures can be stitched together to get larger ones, and then you gradually introduce that kind of granularity and scale. That’s the approach we’re taking to break down a fairly complex problem into something more learnable and tractable.”
Still, the process depends heavily on data engineering. Before training can even begin, raw machine data must be cleaned and organized, work that Yang called both resource-intensive and essential. That experience, he said, highlights why Cisco Data Fabric is a critical piece of the AI picture. If Splunk’s own AI team had to invest so deeply in preparing data for its foundation model, enterprises attempting to train models on their own proprietary data will face the same hurdles. By embedding tools for federation, filtering, and structure into the Data Fabric, Cisco aims to give customers tools to manage these challenges without reinventing the wheel. Splunk plans to publish its methodology later this year and incorporate the foundation model into the AI Toolkit, so that customers can apply the same techniques to their own machine data.
Splunk as a Strategic Pillar for AI
Jeetu Patel, President & Chief Product Officer, Cisco, and Kamal Hathi, SVP and GM, Splunk, hold a press briefing at .Conf25 in Boston.
After outlining the technical vision behind the Data Fabric, company executives turned to the bigger picture: how Splunk fits into the company’s future strategy and what has changed since the acquisition.
Cisco officially acquired Splunk in March 2024. At the time, Patel famously promised not to “screw up” Splunk in response to customers’ fears that the company could change with new ownership. At a conference press briefing, Patel explained how, since acquiring Splunk, Cisco has reshaped its internal structure to better align with the demands of AI. Earlier this year, the company reorganized its teams around three priorities—AI-ready data, future-proof workplaces, and digital resilience—and consolidated its product efforts into a single organization. He said the goal is to eliminate inefficiencies between groups and ensure that data and decisions flow quickly across the company, allowing Cisco and Splunk to “move at startup speed, at scale.”
At the briefing, Patel reaffirmed his company’s commitment to Splunk, noting that its technology has the potential to redefine the ways AI can add value to the market.
“Splunk is extremely strategic to the future of Cisco. We are going to be unapologetically making sure that we supercharge the innovation velocity with Splunk,” he said. “You should expect greater levels of innovation from us. We are going to be AI first in everything that we do, and the problem we’re going to be solving is making sure that AI becomes machine data ready.”