Cisco AI POD for Splunk Brings Self-Managed AI to On-Premises Environments

Cisco announced a set of new Splunk capabilities at Splunk.conf in Denver on September 15, 2026, led by the immediate availability of Cisco AI POD for Splunk, which brings self-managed Splunk AI to on-premises, private cloud, and air-gapped environments through an expanded partnership with NVIDIA.

Cisco AI POD for Splunk

Cisco Secure AI Factory with NVIDIA is the company’s reference architecture for assembling the full AI stack from Cisco AI PODs. The newest of those configurations, Cisco AI POD for Splunk, pairs new AI runtime software with Cisco infrastructure, NVIDIA accelerated computing, and a Kubernetes-based architecture that Cisco describes as pre-validated and optimized for Splunk AI workloads. For customers running their own infrastructure, partners including Accenture, bitsIO, Wipro, and World Wide Technology are ready from day one to help stand up the deployment.

Splunk’s product documentation states that the system’s AI Tier software, which delivers the supported Splunk AI capabilities, is integrated with Cisco UCS compute, NVIDIA RTX PRO 6000 GPU acceleration, Cisco networking, OpenShift, and the Splunk Operator for Kubernetes in a pre-sized, pre-validated system backed by single-vendor support. The customer supplies the data-center environment and keeps ownership of operations and security. Splunk documents two deployment paths: the integrated Cisco AI POD for Splunk, or standalone AI Tier software installed on customer-qualified GPU and Kubernetes infrastructure, with no incremental AI Tier software cost. The documentation also states that the system is not a general-purpose AI compute platform or standalone GPU appliance, but a Cisco infrastructure deployment designed for Splunk AI workloads.

Splunk AI Assistant is available now, and Agent Launchpad is scheduled for later in 2026. Both run on this layer, bringing ad-hoc agentic investigations and custom agent building for a range of use cases including the agentic security operations center to teams that run Splunk in their own data centers. Customers can also self-host a selection of open and proprietary generative AI models for Splunk Enterprise workloads, including the Cisco Deep Time Series Model, Google Gemma 4, and OpenAI GPT-OSS 20B, and Cisco said NVIDIA Nemotron open models will be added in the coming months.

“One of the biggest roadblocks to enterprise AI today is that it’s too hard to deploy,” said Jeetu Patel, Cisco’s President and Chief Product Officer, in the company’s announcement, adding that customers want to know whether they can trust AI to do the job, whether they can afford it, and whether they can secure it. Justin Boitano, NVIDIA’s Vice President of Enterprise AI, said enterprises need to bring AI to where their data lives, particularly when security and sovereignty requirements keep critical workloads on-premises, and described the joint work as bringing AI agents directly to Splunk on NVIDIA accelerated computing.

Agent Observability and Tokenomics

Splunk Agent Observability, initially announced as an on-premises offering, is now available in Splunk Observability Cloud and in Cisco Cloud Control. Cisco said the offering evaluates agent and model behavior, observes performance across the AI stack, and applies runtime guardrails that block inaccurate or unsafe actions, such as hallucinations or leaking sensitive data.

The new Tokenomics solution, part of Splunk Agent Observability, records and attributes token expenditure across AI agents and employees’ use of coding agents including Claude Code, Codex, and Cursor. Cisco said it will also forecast consumption patterns, using the Cisco Deep Time Series Model, to project where spending is headed before a billing period ends, and that the resulting insights are meant to help organizations operationalize a tokenomics framework and tie AI spend to business outcomes.

The announcement also introduced Observability Studio, which Cisco said is designed to make new applications observable, measurable, and production-ready from the start, and a Network Intelligence App that brings Cisco network topology, device health, and events into Splunk so network teams can trace an alert to the device behind it. New Observability Cloud editions, Essentials and Premier, simplify how customers buy and expand observability across their business, with cost-effective log analytics for debugging application and infrastructure problems, according to Cisco.

Agentic SOC, Enterprise Security Editions, and AWS Agreement

New purpose-built agent capabilities expand the Splunk Agentic SOC Workforce across detection engineering, proactive threat hunting, autonomous investigation, coordinated response, and policy governance. Cisco said the agents correlate full-stack machine data across network, cloud, application, and identity environments and produce explainable verdicts that reduce alert noise and accelerate mean time to remediate.

New Exposure Analytics enhancements add broader asset coverage, historical change tracking, and business-specific risk insights, connecting exposure context to live security activity across Splunk, Cisco, and a third-party ecosystem. New capabilities in Splunk Enterprise Security Essentials extend agentic security operations to more security teams, while Splunk Enterprise Security Premier adds deeper agentic autonomy along with the full capabilities of Splunk Enterprise Security.

Splunk and AWS are also expanding their long-standing relationship into joint product development through a multi-year agreement to co-develop security solutions aimed at AI-driven attacks. Under the arrangement described in the announcement, Splunk contributes its data platform and detection depth while AWS contributes global cloud scale, with the joint work intended to put agentic support in the hands of analysts across detection, investigation, and response while preserving governance and analyst control.