This article is based on reporting originally published by Forbes and covers announcements made at Splunk’s annual .conf19 user conference in Las Vegas.
Overview
Splunk’s annual .conf19 conference drew more than 11,000 attendees to Las Vegas, including over 2,200 partners. The event served as the primary stage for Splunk to announce new products, share its platform roadmap, and articulate a unifying vision: moving customers beyond passive data collection toward active, data-driven decision-making. Splunk described this shift under the banner of its Data-to-Everything platform and the theme of turning data into doing.
The Tuesday morning keynote was particularly dense with announcements spanning cloud authorization, security operations, AIOps, stream processing, and social impact investment. Below is a breakdown of the major items.
Key Announcements at .conf19
Zonehaven Investment — Splunk Ventures Social Impact Fund
Splunk announced the inaugural investment from its newly launched Splunk Ventures Social Impact Fund, a $50 million fund targeting early-stage organizations that use data-driven approaches to create measurable social impact. The first portfolio company was Zonehaven, a platform designed to give fire departments and emergency response agencies real-time situational awareness during wildfire events.
Zonehaven combines intelligent evacuation zone management, advanced fire behavior modeling, real-time weather data, and continuous fire sensing. The timing of the announcement was notable: at the time of the conference, thousands of residents in California were being ordered to evacuate due to active wildfires, underscoring the operational relevance of the technology.
FedRAMP Authorization for Splunk Cloud
Splunk revealed that Splunk Cloud had received FedRAMP authorization from the General Services Administration (GSA) FedRAMP Program Management Office (PMO). FedRAMP (Federal Risk and Authorization Management Program) is the US government’s standardized security assessment framework for cloud services.
Achieving this authorization opens Splunk Cloud to federal agencies and their partners, enabling them to apply Splunk’s analytics capabilities to IT operations, security monitoring, and IoT use cases while meeting federal compliance requirements. For agencies that previously had to rely solely on on-premises Splunk Enterprise deployments, FedRAMP authorization removes a significant barrier to cloud adoption.
Enhanced IT Operations Portfolio
Splunk announced updates to its IT operations product line aimed at expanding its AIOps capabilities and supporting organizations at different stages of cloud migration. Key updates included:
- Splunk IT Service Intelligence (ITSI) — updated to improve service monitoring and anomaly detection using machine learning.
- Splunk App for Infrastructure (SAI) — updated to provide deeper visibility into hybrid infrastructure environments.
- Integrations with Splunk VictorOps and Splunk Phantom — tighter connections between alerting, incident response automation, and on-call management to reduce mean time to resolution (MTTR).
Together, these enhancements extend Splunk’s observability portfolio, allowing teams to correlate infrastructure metrics, log data, and service health in a single workflow.
Splunk Mission Control and the Security Operations Suite
One of the most significant security announcements was the launch of Splunk Mission Control as part of the new Splunk Security Operations Suite. Mission Control is a cloud-based solution that unifies three previously separate security products into a single analyst interface:
- Splunk Enterprise Security (ES) — the SIEM component for threat detection and investigation.
- Splunk Phantom — the SOAR (Security Orchestration, Automation and Response) component for automated playbooks and response actions.
- Splunk User Behavior Analytics (UBA) — the UEBA component for detecting insider threats and anomalous user activity.
By bringing SIEM, SOAR, and UEBA into one unified experience, Mission Control aims to reduce analyst context-switching and provide end-to-end visibility across the full threat detection, investigation, and response lifecycle. Security teams managing complex, high-volume alert environments stand to benefit most from this consolidation.
Increased Scale and Speed: Enterprise 8.0, DFS, and DSP
Splunk announced the general availability of three products focused on scaling data ingestion, search, and processing:
- Splunk Enterprise 8.0 — the latest major release of the flagship on-premises platform, bringing performance and usability improvements.
- Splunk Data Fabric Search (DFS) — a capability that federates search queries across multiple, heterogeneous data stores, presenting results in a single unified view. DFS is designed to eliminate the need to move or consolidate data before analyzing it.
- Splunk Data Stream Processor (DSP) — a real-time stream processing solution that continuously ingests high-velocity, high-volume data from multiple sources, applies transformations or enrichments in flight, and routes results to Splunk or third-party destinations.
Together, DFS and DSP address two common pain points for large-scale Splunk customers: the difficulty of querying data that is spread across disparate systems, and the latency involved in batch-loading data before it can be searched.
The Vision: From Data Collection to Data Action
Prior to the conference, Forbes spoke with Tim Tully, then Senior Vice President and Chief Technology Officer at Splunk, about the company’s long-term direction. Tully’s perspective offers useful context for understanding why Splunk framed .conf19 around the idea of turning data into doing.
Tully observed that data volume is no longer the core problem for most organizations. Enterprises today collect enormous quantities of data from a growing variety of devices, services, and platforms. The harder challenge is correlation and aggregation: stitching together data from disparate sources in a way that makes downstream analysis tractable. He argued that too many teams spend the majority of their effort understanding where data comes from rather than what to do with it — always looking backward at data lineage instead of forward at actionable insight.
The solution Splunk is pursuing centers on what Tully called unbounded learning: the ability to apply machine learning to unstructured, unsupervised streaming data without requiring data scientists to build and train models in advance. This approach is intended to democratize analytics, making it possible for teams without dedicated ML expertise to benefit from intelligent pattern detection and anomaly identification.
Tully also pushed back on what he described as the industry habit of using machine learning as a marketing differentiator. His position: customers are not buying machine learning as a feature. They are buying faster, better outcomes. The value of ML is invisible when it works well — it simply delivers results that would otherwise take analysts much longer to reach. That framing shaped how Splunk positioned its AIOps and security analytics announcements at .conf19.
Summary
Splunk’s .conf19 was a product-dense event with announcements spanning security operations, cloud compliance, stream processing, IT observability, and social impact. The connective thread across all of them was Splunk’s ambition to reduce the distance between raw data and actionable decisions — whether that means unifying a security analyst’s workflow in Mission Control, enabling real-time stream processing with DSP, or applying machine learning without manual model building. For DevOps and platform engineering teams evaluating Splunk’s roadmap, the move toward federated search (DFS) and real-time processing (DSP) alongside tighter AIOps integration represents the most operationally significant direction from the conference.