Accelerating network monitoring with machine learning and AI
As a network engineer, you've noticed that your network traffic data has a complex distribution, and some data has temporal dependencies on other data. Because your data isn't normally distributed, you find that trying to use the SPL stats command for anomaly detection is not very effective. You would like to start integrating Splunk AI capabilities into your workflows to be more effective.
How to use Splunk software for this use case
Splunk provides several tools you can add on to the Splunk platform deployment to be more effective. Using the Splunk AI Toolkit and the Splunk App for Data Science and Deep Learning, the Splunk platform supports all of these anomaly detection types, as well as custom algorithms. Best practice is not to use a single one of these models, but rather to use composite models to reduce false positives. Multiple models create a combined risk score, and then you set a threshold to decide when there is really an incident.
| Probability | Clustering | Change | Prediction |
|---|---|---|---|
|
Learns the normal event distribution and detects when events deviate from it. Algorithms include:
|
Uses the idea that entities in the same group have similar characteristics. Algorithms include:
|
Focuses on sudden changes in a trend in time-series data. Algorithms include:
|
Measures the difference between actual observation and the predicted result. Also uses the direct outcome from predictions. Algorithms include:
|
The following video shows a few of these algorithms in action.
In addition to helping you create more robust anomaly detection algorithms, the AI Toolkit can also enrich detected anomalies. The ai command in the toolkit sends data from the Splunk platform to third-party LLM providers. Unlike regex, which retrieves information based on patterns, sending your data to LLMs gives you the power of natural language interactions. This can be helpful for:
- data summarization
- data enrichment
- anomaly detection
- trend analysis
- field extraction
One use case for this is call center data. The conversational nature of transcripts from a call center makes data extraction using regex impossible. But an LLM can help extract useful information in JSON format.
Another great use case is the retrieval-augmented generative AI integration using DSDL. This allows you to use your static data inside the Splunk platform to enrich the data you plan to send to the LLM to help it better inform next steps. This is shown in the following demo.
Additional resources
Now that you have an idea of how AI features in the Splunk platform can improve your network monitoring, watch the full talk from Cisco Live Melbourne 2025, Accelerate Network Operations with ML & AI innovations from Splunk. In the talk, you'll learn about the Splunk AI Toolkit, the Splunk App for Data Science and Deep Learning, and the Splunk MCP server architecture. You can also click into the following articles to learn about additional AI features in Splunk software.
- Splunk Lantern Article: Getting started with Splunk Artificial Intelligence
- Splunk Help: About the ai command
- Splunk Help: About MCP server for Splunk platform