This article introduces OpenObserve, an open-source observability platform designed to provide a cost-effective alternative to proprietary services like Datadog. By leveraging cloud object storage such as S3 for storing logs, metrics, and traces, it significantly reduces the financial burden of data retention. Built with Rust for performance, it aims to simplify the observability stack while maintaining high scalability and speed.
- Drastic reduction in costs compared to traditional SaaS monitoring tools
- Unified platform for handling logs, metrics, and traces
- High-performance architecture powered by Rust and object storage integration
- Drastic reduction in costs compared to traditional SaaS monitoring tools
- Unified platform for handling logs, metrics, and traces
- High-performance architecture powered by Rust and object storage integration
Splunk .conf in Denver Sept 2026: The core theme focuses on "Agentic AI"—the transition toward autonomous workflows in security, observability, and operations to manage increasing data complexity and digital risk.
**Sessions**
* **Powering the Rise of the Agentic Enterprise:** Transforming security/ops with scalable, trust-based AI workflows.
* **See Inside Your Agentic AI Applications:** Tracing Python agent interactions to detect hallucinations and tool failures.
* **The Future is Here: What’s New in Splunk Security:** Transitioning to an "Agentic SOC" via automated orchestration.
* **The Platform for Your Agentic Enterprise:** Unlocking cross-domain insights through unified data and AI.
* **What's New in Platform:** Using a unified data fabric for predictive, agentic operations.
* **5 ML Algorithms in Under 5 Lines of Code:** Reducing alert fatigue using simple SPL/MLTK implementations.
* **Accelerate Digital Resilience (Cisco & Splunk):** Maximizing ROI through integrated ecosystem use cases.
* **AI Troubleshooting and Remediation Agents:** Using AI SRE agents to accelerate root cause analysis.
* **Accelerate SmartStore Searches with VAST Data:** Reducing storage costs via InfiniteCache integration.
* **The Cisco & Splunk Partner Playbook:** Strategies for scaling business in the AI era.
* **Accelerating Your Journey to Agentic Observability:** Navigating 4 steps toward agent-driven monitoring.
* **A Compromised Account Alerting System:** Automating detection of suspicious user behavior.
* **Advanced Threat Detection (DSDL & RBA):** Using machine learning for behavioral risk scoring.
* **Advancing Security Operations with ESCU Innovations:** Leveraging new high-fidelity threat intelligence content.
* **Agentic Data Ingestion (Anthropic's Claude):** Automating Splunk Add-On development using GenAI.
* **Agentic Detection Posture Management:** Using AI to rapidly identify and close detection gaps.
* **Agentic Incident Command:** Deploying coordinated AI agent teams for full incident lifecycles.
* **Hands-on Agent Attack Analysis:** Building anomaly detections from raw agent telemetry.
* **Build Your Own SOC AI Agent (Workshop):** Hands-on guide to building custom agents with guardrails.
* **Triage and Response at Scale:** Using Triage and SOP Agents for automated incident response.
* **Agents Are Easy, Trust Is Hard:** Implementing governance in cohesive agentic operations via Cisco Data Fabric.
* **AI Assistant V2 Unlocked (Workshop):** Hands-on with Agent Mode and organizational knowledge integration.
**Sessions**
* **Powering the Rise of the Agentic Enterprise:** Transforming security/ops with scalable, trust-based AI workflows.
* **See Inside Your Agentic AI Applications:** Tracing Python agent interactions to detect hallucinations and tool failures.
* **The Future is Here: What’s New in Splunk Security:** Transitioning to an "Agentic SOC" via automated orchestration.
* **The Platform for Your Agentic Enterprise:** Unlocking cross-domain insights through unified data and AI.
* **What's New in Platform:** Using a unified data fabric for predictive, agentic operations.
* **5 ML Algorithms in Under 5 Lines of Code:** Reducing alert fatigue using simple SPL/MLTK implementations.
* **Accelerate Digital Resilience (Cisco & Splunk):** Maximizing ROI through integrated ecosystem use cases.
* **AI Troubleshooting and Remediation Agents:** Using AI SRE agents to accelerate root cause analysis.
* **Accelerate SmartStore Searches with VAST Data:** Reducing storage costs via InfiniteCache integration.
* **The Cisco & Splunk Partner Playbook:** Strategies for scaling business in the AI era.
* **Accelerating Your Journey to Agentic Observability:** Navigating 4 steps toward agent-driven monitoring.
* **A Compromised Account Alerting System:** Automating detection of suspicious user behavior.
* **Advanced Threat Detection (DSDL & RBA):** Using machine learning for behavioral risk scoring.
* **Advancing Security Operations with ESCU Innovations:** Leveraging new high-fidelity threat intelligence content.
* **Agentic Data Ingestion (Anthropic's Claude):** Automating Splunk Add-On development using GenAI.
* **Agentic Detection Posture Management:** Using AI to rapidly identify and close detection gaps.
* **Agentic Incident Command:** Deploying coordinated AI agent teams for full incident lifecycles.
* **Hands-on Agent Attack Analysis:** Building anomaly detections from raw agent telemetry.
* **Build Your Own SOC AI Agent (Workshop):** Hands-on guide to building custom agents with guardrails.
* **Triage and Response at Scale:** Using Triage and SOP Agents for automated incident response.
* **Agents Are Easy, Trust Is Hard:** Implementing governance in cohesive agentic operations via Cisco Data Fabric.
* **AI Assistant V2 Unlocked (Workshop):** Hands-on with Agent Mode and organizational knowledge integration.
At GrafanaCON 2026, Grafana Labs announced significant updates including the launch of Grafana 13 and a major architectural overhaul for Loki. The new Loki design moves away from replication-at-ingestion toward using Kafka as a durability layer to reduce data duplication and improve query performance. Additionally, the company introduced GCX, a new CLI tool in public preview designed to integrate observability data directly into agentic development environments like Claude Code and Cursor, allowing engineers to resolve production issues without leaving their coding tools.
:
- Loki rearchitected with Kafka to reduce storage overhead and improve query speed.
- Introduction of GCX CLI for seamless observability integration within AI coding agents.
- Launch of Grafana 13 featuring dynamic dashboards and expanded data source support.
- New AI Observability product in public preview for monitoring LLM applications.
:
- Loki rearchitected with Kafka to reduce storage overhead and improve query speed.
- Introduction of GCX CLI for seamless observability integration within AI coding agents.
- Launch of Grafana 13 featuring dynamic dashboards and expanded data source support.
- New AI Observability product in public preview for monitoring LLM applications.
STCLab's SRE team shares their experience building an AI-driven investigation pipeline to automate the triage of Kubernetes alerts. By utilizing HolmesGPT, they implemented a ReAct pattern that allows LLMs to autonomously select tools like Prometheus, Loki, and kubectl based on specific context. The core finding was that high-quality markdown runbooks containing exclusion rules were more critical for successful investigations than the underlying AI model itself.
Key points:
* Implementation of HolmesGPT using the ReAct agent pattern for autonomous troubleshooting.
* Integration with Robusta to manage Slack routing, deduplication, and thread matching.
* The vital role of runbooks in narrowing search spaces and reducing wasted tool calls.
* Comparison between self-hosted models via KubeAI and managed API approaches.
* Significant reduction in manual triage time from 20 minutes to under two minutes per investigation.
Key points:
* Implementation of HolmesGPT using the ReAct agent pattern for autonomous troubleshooting.
* Integration with Robusta to manage Slack routing, deduplication, and thread matching.
* The vital role of runbooks in narrowing search spaces and reducing wasted tool calls.
* Comparison between self-hosted models via KubeAI and managed API approaches.
* Significant reduction in manual triage time from 20 minutes to under two minutes per investigation.
Prove AI is developing an observability-first foundation designed for production generative AI systems. Their mission is to enable engineering teams to understand, diagnose, and remediate failures within complex AI pipelines, including LLM inference, retrieval processes, and agent orchestration.
The current release, v0.1, provides an opinionated observability pipeline specifically for generative AI workloads through:
- A containerized, OpenTelemetry-based telemetry pipeline.
- Preconfigured collection of traces, metrics, and logs tailored for AI systems.
- Instrumentation patterns for RAG pipelines, embeddings, LLM inference, and agent-based systems.
- Compatibility with standard backends like Prometheus.
The current release, v0.1, provides an opinionated observability pipeline specifically for generative AI workloads through:
- A containerized, OpenTelemetry-based telemetry pipeline.
- Preconfigured collection of traces, metrics, and logs tailored for AI systems.
- Instrumentation patterns for RAG pipelines, embeddings, LLM inference, and agent-based systems.
- Compatibility with standard backends like Prometheus.
Ship measurable improvements in your GenAI systems with Opik, your open-source LLM observability and agent optimization platform. Trusted by over 150,000 developers and thousands of companies.
Elastic's new Streams feature uses AI to transform noisy logs into actionable insights, helping SREs diagnose and resolve issues faster. The article discusses how AI is poised to become the primary tool for incident diagnosis and address skill shortages in IT infrastructure management.
Here's a breakdown of the technical details:
* **Problem:** Modern IT (especially Kubernetes) generates massive amounts of log data (30-50GB/day per cluster) making manual analysis for root cause identification slow, costly, and prone to errors. Existing observability tools often treat logs as a last resort.
* **Elastic's Solution (Streams):**
* **AI-powered Parsing & Partitioning:** Automatically extracts relevant fields from raw logs, reducing manual effort.
* **Anomaly Detection:** Surfaces critical errors and anomalies from logs, providing early warnings.
* **Automated Remediation:** Aims to not only identify issues but also suggest or automatically implement fixes.
* **Workflow Shift:** Streams aims to move away from the traditional observability workflow (metrics -> alerts -> dashboards -> traces -> logs) to a log-centric approach where AI proactively processes logs to create actionable insights.
* **Future Direction:** The article highlights the potential of **Large Language Models (LLMs)** to further automate observability, including generating automated runbooks and playbooks for remediation. LLMs could also help address the shortage of skilled SREs by augmenting their expertise.
* **Integration:** Streams is integrated into Elastic Observability.
Here's a breakdown of the technical details:
* **Problem:** Modern IT (especially Kubernetes) generates massive amounts of log data (30-50GB/day per cluster) making manual analysis for root cause identification slow, costly, and prone to errors. Existing observability tools often treat logs as a last resort.
* **Elastic's Solution (Streams):**
* **AI-powered Parsing & Partitioning:** Automatically extracts relevant fields from raw logs, reducing manual effort.
* **Anomaly Detection:** Surfaces critical errors and anomalies from logs, providing early warnings.
* **Automated Remediation:** Aims to not only identify issues but also suggest or automatically implement fixes.
* **Workflow Shift:** Streams aims to move away from the traditional observability workflow (metrics -> alerts -> dashboards -> traces -> logs) to a log-centric approach where AI proactively processes logs to create actionable insights.
* **Future Direction:** The article highlights the potential of **Large Language Models (LLMs)** to further automate observability, including generating automated runbooks and playbooks for remediation. LLMs could also help address the shortage of skilled SREs by augmenting their expertise.
* **Integration:** Streams is integrated into Elastic Observability.
This article details how Nubank built its own in-house logging platform to address issues of cost, scalability, and control over their logging infrastructure. Initially reliant on a vendor solution, they found costs rising unpredictably and experienced limitations in observability and data retention.
To solve this, Nubank divided the project into two major steps: **The Observability Stream** (ingestion and processing) and the **Query & Log Platform** (storage and querying).
* **Observability Stream:** Fluent Bit for data collection, a Data Buffer Service for micro-batching, and an in-house Filter & Process Service.
* **Query & Log Platform:** Trino as the query engine, AWS S3 for storage, and Parquet for data format.
The new platform currently ingests 1 trillion logs daily, stores 45 PB of searchable data with a 45-day retention, and handles almost 15,000 queries daily. Nubank reports the platform costs 50% less than comparable market solutions while providing them with greater control, scalability, and the ability to customize features. The project underscored Nubank's value of challenging the status quo and leveraging a combination of open-source and in-house development.
To solve this, Nubank divided the project into two major steps: **The Observability Stream** (ingestion and processing) and the **Query & Log Platform** (storage and querying).
* **Observability Stream:** Fluent Bit for data collection, a Data Buffer Service for micro-batching, and an in-house Filter & Process Service.
* **Query & Log Platform:** Trino as the query engine, AWS S3 for storage, and Parquet for data format.
The new platform currently ingests 1 trillion logs daily, stores 45 PB of searchable data with a 45-day retention, and handles almost 15,000 queries daily. Nubank reports the platform costs 50% less than comparable market solutions while providing them with greater control, scalability, and the ability to customize features. The project underscored Nubank's value of challenging the status quo and leveraging a combination of open-source and in-house development.
This article explores how prompt engineering can be used to improve time-series analysis with Large Language Models (LLMs), covering core strategies, preprocessing, anomaly detection, and feature engineering. It provides practical prompts and examples for various tasks.
TraceRoot.AI is an AI-native observability platform that helps developers fix production bugs faster by analyzing structured logs and traces. It offers SDK integration, AI agents for root cause analysis, and a platform for comprehensive visualizations.
