Getting Started with Cisco Data Fabric powered by the Splunk platform
Today’s leading organizations use the Splunk platform to federate data, correlate it at scale, and transform it for AI. Leveraging the Cisco Data Fabric architecture, the Splunk platform analyzes data where it lives at lower cost, connects data in real time across domains, and unlocks machine data for model training and agentic action. The results are better data economics, less operational complexity, and a trusted foundation for people and AI to investigate, decide, and act faster.
This article walks you through that data journey from end to end – how to transform machine data into trusted agentic action.
Key capabilities of Cisco Data Fabric
Cisco Data Fabric powered by the Splunk platform brings together several capabilities into a single data journey:
- Data Management: Brings data into the platform and prepares it, using familiar collection methods and processing tiers.
- Machine Data Lake: A managed, cost-effective landing zone that retains complete raw data without indexing it all upfront.
- Catalog: Organizes the data estate, making datasets discoverable and activated for a specific workload.
- Federated Search: Searches across supported repositories through a unified experience, regardless of where the data lives.
- Splunk AI Assistant: Provides a natural-language entry point that can optimize and even run investigations with human oversight.
Cisco Data Fabric is not a single product to install. It’s an architecture that connects capabilities you might already have access to in Splunk Cloud Platform. This guide walks through how those capabilities work together across a single data journey.
Before you begin: identify the use case
Before configuring an endpoint or pipeline, consider these five questions to clarify the objective of your data journey:
- How quickly must the data become searchable?
- How frequently will people, detections, dashboards, or automated content search it?
- How long must your organization retain it?
- Does the workload require raw-event flexibility, structured analytics, or access from an external tool?
- Where does the data gravity reside and do you want to manage its lifecycle?
Your answers to these questions determine which processing tier, landing zone, and promotion path make sense for a given data source, and they might be different for different sources or even for the same source over time.
The data journey at a glance
Cisco Data Fabric supports a repeatable path from retained data to operational action:
- Onboard and route data into Machine Data Lake, Splunk platform indexes, or both.
- Land the data in Machine Data Lake as the raw source of truth.
- Discover the dataset in Catalog before committing to further investment.
- Promote selectively to a Splunk platform index or a Machine Data Lake analytics table when a workload becomes repeated, interactive, or structured.
- Search across the estate with Federated Search, matching the search method to the tier.
- Optimize investigations with the Splunk AI Assistant in Agent Mode.
It avoids making irreversible value judgments at ingest time and gives teams a repeatable path from retained data to operational action.
Next steps
Click the Next step button below to learn how to onboard, route, and promote data with Cisco Data Fabric.