Splunk can work with all kinds of data it can see, but did you know that Splunk can seamlessly utilize external Large Language Models - even directly in SPL? While at Cisco Live EMEA, I had a chance to talk with Philipp Drieger about advancements in the Splunk AI Toolkit that allow you to use domain expertise from LLMs directly in Splunk. Following are some of the resources Philipp mentioned during the video:

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

Hey everybody, we’re out here at Cisco Live in Amsterdam and I ran into Philip here and we’ve been chatting about AI toolkit and the time series foundation model and there’s a a lot of new things happening there. Can you give us some highlights? >> Thanks for having me Jason. Good to meet good old friends and different places in the world. So yeah, AI is a hot topic especially in the era of patented AI. I think uh we see a lot of great innovation coming especially very much tied to our old longstanding platform story that we have at Splunk. So as you know our customers process some of the most precious most insightful data that they can gather from all the different sources and they can on the one hand build models on top of that data historically as we do with the AI toolkit. But now if you think about extending this also to ready built models like the Cisco time series foundation one or the security foundation model there are also other available large language model or uh uh small language models. So kind of the different flavors if you wish. Good news is we can all more or less plug them into Splunk and make them work with the data in Splunk in different ways. So to give you a few examples, imagine you have a lock message that you don’t really understand and this is the one you actually found in a very classic way searching for errors that occur in your system landscape. You are not the domain expert on that lock maybe, but you found the error. Great. But what does it actually tell me? So you could pipe it to an LLM, get a response of it. And if you use a optimized LLM that also makes use of specific knowledge that is embedded into it, you get a almost too good to be true answer maybe. So how about that? We are not suffering from not understanding the lock message. We can actually get a more insightful approach to what’s going on. So that’s just one example. Say we see different patterns of those use cases appearing. think of just a next level of deeper insights into the data you already have. >> So if I understand correctly like even in a Splunk search SPL I can go leverage other models directly from that search bar. Is that accurate? >> Exactly. This was one of the announcements we have seen this week that we have so-called Splunk hosted models. This literally makes it very easy for our customers to tap into the model and make it useful for the data you process all from the search bar. So >> if you want to get it technically um we do a hype AI command >> and you just have a prompt that you attach to it and you could even specify a field in your data and boom off this field you would work with the LLM get the response and you could iterate. So it’s not just a one time off. You could chain it with other things as you would chain other SPL commands. So this gives you a pretty rich set of also different capabilities. Now if you mix in even classic machine learning for other ways of detecting and and improving things. >> I think this is really a very very big tool val you you can really tab in and make it all use straight away in the search. >> Yeah, that’s amazing. I think it really opens up a lot of the LLMs out there directly from your Splunk environment. It’s really cool. >> Yeah. >> Yeah. So, time series foundation model, how does that fit into the picture here as well? >> This is another for me really next dimension um of how we can work with time series data. Time series data usually we have events in Splunk, >> but these events can be used to extract maybe a certain KPI measurement. think of a latency to connect to a system or on the network you can think of how many bytes are transferred in and out and so on. Um of course also arbitrary other KPIs business KPIs you could define. Um now this is all a number moving through time time series. The challenge is there are different algorithmic approaches to work with this time series data like ARMA state based forecast maybe an specific anomaly detection algorithm like a density function that you went to run on that it’s useful and it’s I would compare it to different lenses into a reality that you’re observing from the data now the time series foundation model is a pre-trained model that was fed with millions of different time series with different seasonality patterns with different you could say natures how time series move and very similar to an LLM that you have trained with a lot of language data lot of natural language data you could think of it training an LLM with all of these different variations of time series so that’s the vocabulary so to speak and the advantage is now you can apply this straight away on your existing time series and say for two primary use cases detect obviously anomalies. >> So where is something in the time series happening that is off? It might be a strong spike occurring. It might be some subtle fluctuation but it always occurs maybe at midnight and this is what you can spot there. This is the one obvious use case anomaly detection. The other one is >> forecasting. So you want to know in the next 5 minutes, in the next 10 minutes depending of course on the time interval you pick what is going on next and this is very insightful to be more predictive in that sense uh how you operate how you might detect an outage before it actually happens because you see it already coming more or less in different data beats. So this is the the big uh potentials we have with this time series model. The other big advantage is you don’t need to be a data scientist to build such a model. You can literally just take it off the shelf, plug it into uh your Splunk system, make it work. And the good news is it’s today also available as a Splunk hosted variant. So you don’t need to take care about where to put the model, have a GPU instance ready. So, of course, it requires to connect to our cloud services, but it’s a very easy and quick way to get going. And once you have your first experiments running, your first detections may be improved, your first predictions made better, you can take it to the next level. >> That that’s amazing. A lot of great innovation there. Now, I want to go get more educated and get more information. How can I go learn some more? So definitely I can recommend a lot of good blog posts that we have available from all the great Splunk colleagues um around us um because well you sometimes discover something new you do your research um you get things out the door documentation pages of course as well we have a great place called Lantern where a lot of different descriptions of use cases and patterns um how to build them out are there so I think that’s the three top three go-to sources that that come to my mind. >> That’s really awesome information. Looking forward to getting started. Thanks so much for your time. I appreciate it. Thanks, Chris.