At .conf26: Splunk Foundation Models Help Teams Find the Signals That Matter

Three Foundation Models Give AI Specialized Eyes for Detection

Large language models (LLMs) can reason over context to support triage and response. Finding an operational change often starts earlier: detecting weak signals across metrics, events, logs, and traces. Sending every raw signal to a large model can add latency and cost. Purpose-built models can help identify which machine data deserves attention.

We built three specialized deep learning foundation models to analyze machine data: CDTSM detects unusual behavior in time-series metrics. Log Reasoning Foundation Model helps identify patterns and useful evidence in logs. Graph Reasoning Foundation Model is designed to connect signals across entities and over time. Together, these models aim to surface more useful signals with less compute, latency, and cost, while preserving evidence practitioners need to investigate and act.

1. CDTSM Scales Anomaly Detection Without Training Every Metric

Introduced at .conf25, CDTSM is now generally available through Splunk AI Toolkit. It learns expected behavior and flags deviations in services, pipelines, or workloads without training each metric. Forecasting helps teams see where a signal may be heading. Teams can use a hosted model in Splunk Cloud or self-host it through Cisco AI POD for Splunk.

CDTSM in Action: Mitiga Detects Collection Gaps Within Hours

Mitiga shows the value of detecting changes early. Across more than 10,000 log-collection jobs, an unexpected volume drop can create a security blind spot. Using CDTSM to analyze collection-volume time series, Mitiga cut detection from up to 24 hours to a few hours and reduced false-positive alerts by roughly 95%.

Cisco’s Provider Mobility Business Unit (PMBU) evaluated CDTSM on continuous mobile-core session-count and throughput data, without training each time series. Early results indicated fewer false positives while broadly maintaining detection quality. Validation is ongoing, so these findings are directional; they suggest the potential to monitor more signals without tuning each one.

Detection also helps protect the data behind decisions. A stalled pipeline can leave dashboards incomplete. In a planned data-ingest use case, CDTSM could forecast expected pipeline behavior and surface gaps that static thresholds may miss.

2. Log Reasoning Preview: Find Useful Evidence in Large Volumes of Logs

When an alert needs investigation, teams must find useful clues across millions of repetitive log messages. At .conf26, we previewed how Log Reasoning could support Log Pruner by removing duplicates, grouping similar patterns, keeping representative examples, and ranking log lines by service, time window, or alert.

This smaller context could help AI SRE and AI Assistant workflows form hypotheses practitioners can test and suggest next steps. The goal is to retain useful evidence while reducing token use, latency, and cost.

3. Graph Reasoning Preview: Connect Weak Signals That Isolated Detections Can Miss

A suspicious login, remote-tool session, first-use command, or device change may seem harmless on its own. Their relationships and sequence can reveal a pattern worth investigating.

Also previewed at .conf26, Graph Reasoning is designed to connect signals from identities, devices, commands, services, and risk over time. We showed how Log and Graph Reasoning could support Splunk Enterprise Security with findings analysts can review when a single rule misses a pattern. Connecting the evidence gives analysts more context for triage and response.

Planned Tokenomics: Forecast Token Consumption for AI Cost Decisions

A planned Tokenomics experience would use CDTSM forecasting to help teams anticipate AI costs. Splunk Agent Observability is offered in Splunk Observability Cloud and Cisco Cloud Control. Tokenomics would forecast token consumption and help teams make budget and optimization decisions.

Start With CDTSM Today; Explore the Previews

Download the latest Splunk AI Toolkit from Splunkbase and apply CDTSM. Validate the results, then apply it to more KPIs. CDTSM works with native metrics and time series derived from logs, without requiring machine learning expertise. Stay tuned for Log and Graph Reasoning releases in FY27.