New Cloud-Enabled Features for Splunk Enterprise Customers via Cloud Connect

Splunk Enterprise customers want access to the latest Splunk capabilities as quickly as possible. Occasionally, new experiences arrive first for Splunk Cloud, leaving self-managed customers without a clear timeline. Cloud Connect is a creative way Splunk is solving that problem.

Cloud Connect gives Splunk Enterprise customers a standard admin path to access curated Splunk-managed services. It helps administrators enable eligible cloud-backed capabilities through a consistent setup, activation, and management experience.

With this release, Cloud Connect supports several customer experiences. Enterprise Security is available today; Splunk IT Service Intelligence 5.0 brings new value for IT operations teams; and Splunk AI Toolkit will release Splunk AI Agent Launchpad, a new AI agent builder for creating, launching, and reviewing operational AI agents directly in Splunk.

What is Cloud Connect?

Instead of each extension requiring a separate connection pattern, Cloud Connect provides a common workflow for setup, activation, and management. Once Cloud Connect is configured on a supported search head, administrators can use the same Cloud Connect experience to activate additional eligible extensions as they become available.

With Cloud Connect, customers can get updates for supported Splunk extensions, use Splunk’s supporting infrastructure, and rely on a consistent connection model across supported extensions. For administrators, that means fewer one-off setup patterns, new features for the same infrastructure footprint, and an intuitive place to manage connected extensions.

Impact

Some Splunk capabilities have historically been slower to reach Splunk Enterprise environments or even been cloud-only offerings. Cloud Connect reduces that gap by giving eligible extensions a supported way to work with Splunk Enterprise environments.

For administrators, the value is practical:

1. Faster access to supported Splunk-managed capabilities.
2. Fewer local infrastructure requirements for extensions that rely on Splunk-operated services.
3. A standard place to activate and manage connected extensions.

That model is especially useful for Enterprise Security and ITSI experiences that benefit from frequent updates or specialized infrastructure. It also supports upcoming Splunk AI Toolkit experiences by giving Splunk Enterprise customers a path to Splunk-managed AI services without adding additional local infrastructure costs.

New Cloud-Enabled Capabilities

Here’s a closer look at what Cloud Connect enables for customers today, and how this model can support more Splunk-managed capabilities over time.

Enterprise Security:

For Enterprise Security Editions customers, Cloud Connect became generally available with Splunk Enterprise Security 8.5.1 in April 2026. It is available for both ES Essentials and ES Premier customers.

1. Included with existing license subscriptions at no additional cost.
2. Provides Splunk Enterprise security customers with access to Threat Intelligence Management (TIM) and Detection Studio (DS) through Cloud Connect.
3. Can be configured directly in the Cloud Connect app or in Enterprise Security’s UI, depending on the administrator's preferred workflow.

More Enterprise Security-specific capabilities are planned for upcoming releases.

Splunk IT Service Intelligence (ITSI):

For Splunk ITSI customers, Cloud Connect support is available with the latest ITSI v5.0 release. It is available to current and new ITSI customers running self-managed Splunk Enterprise.

1. Included with existing license subscriptions at no additional cost.

2. Provides Splunk ITSI customers with access to ITSI's AI-assisted IT operations capabilities through Cloud Connect, powered by the Splunk Cloud Connected model. These include:

   a. AI field extraction for alert onboarding: automatically normalizes incoming alert data into the format ITSI requires.

   b. Event iQ Detect: analyzes alert data to recommend grouping fields and correlation strategies.

   c. Event iQ Diagnose: analyzes alert data and Splunk logs to identify episode root cause and provide next-step recommendations, with change context from tools like ServiceNow and Jira.

3. Can be configured directly in the Cloud Connect app or in ITSI's UI, depending on the administrator's preferred workflow.

More ITSI-specific capabilities are planned for upcoming ITSI releases.

Splunk AI Toolkit and Agent Launchpad:

Cloud Connect also supports the next wave of Splunk AI Toolkit experiences, including Splunk Agent Launchpad. Agent Launchpad gives security and IT teams an AI agent builder directly inside Splunk, so they can build, launch, and review operational agents from the workflows they already use.

Those agents start with trusted Splunk context, including search results, alerts, detections, anomalies, and investigations. This means teams can launch an AI agent with the right operational signal already attached, instead of copying context into a separate tool.

Customers can create no-code or low-code AI agents and connect them to Splunk data, approved MCP tools, and knowledge sources. They can invoke those agents from Search and alerts, then review completed runs with evidence traceability, run history, Markdown responses, and run-scoped follow-up.

Splunk Agent Launchpad is expected to become available later this month for free on Splunkbase.

Future Extensions:

These first extensions are just the beginning of the Cloud Connect model. Over time, customers should expect more eligible Splunk-managed services to follow this same pattern, with a consistent way to connect, activate, and manage them from Splunk Enterprise.

The purpose of Cloud Connect is simple: bring more cloud-backed Splunk capabilities to self-managed customers through a familiar, supported admin experience. It helps administrators enable eligible extensions faster, with a simpler and more consistent path from setup to use.

Cost and Extension Access

Current supported extensions are available at no additional cost or included with existing purchases, including Enterprise Security, ITSI, and Splunk AI Toolkit. Extension access depends on each product, and customers should review each extension's documentation before activating the feature.

Cloud Connect-supported extensions in the future may be included with existing purchases or governed by extension-specific licensing. Customers should review Cloud Connect documentation, extension documentation, and engage their account teams as needed for more information.

Get Started

The Cloud Connect workflow is designed to be consistent:

1. Download or upgrade to the latest Cloud Connect app from Splunkbase.
2. In the Cloud Connect app, enter the desired region, preferred tenant name, and contact information.
3. Link the Splunk Enterprise environment using the one-time password flow.
4. Confirm the extension app is installed.
5. Activate the Cloud Connect extension in the Cloud Connect app.

Before activating an extension, review each extension’s documentation. Supported versions, requirements, regions, data handling expectations, and extension-specific requirements can vary.

Customers should use the most up-to-date Cloud Connect app available to them when setting up, connecting, and enabling Cloud Connect extensions. To learn more, review the Cloud Connect app on Splunkbase, read the Cloud Connect documentation, and contact your Splunk account team with questions about supported extensions.