By AI agents operating across hybrid enterprise environments require real-time telemetry from every surface, cloud workloads, on-premises clusters, and an expanding layer of non-human agentic activity. The assumption that all of this data can or should be centralized before analysis is breaking down under data gravity, regulatory constraints, and token costs that scale faster than the value they return. When large language models are asked to reason over raw log volumes without domain-specific context, they exhaust context windows, burn tokens inefficiently, and return slow, unreliable answers.
In this interview on TFiR, Mangesh Pimpalkhare, SVP and GM of Splunk Platform at Splunk, covers the architectural shift from centralized analytics to a distributed machine data lake, the role of domain-specific foundation models in making LLM-driven operations cost-effective, and how Agent Launchpad gives practitioners a governed path to authoring agentic workflows against live operational telemetry.
Guest: Mangesh Pimpalkhare, SVP and GM of Splunk Platform at Splunk
Show: TFiR
Here is what every platform engineer, security operations practitioner, and AI infrastructure architect needs to know.
Technical Deep Dive
Q: Why is centralizing all enterprise telemetry no longer a viable architecture for AI-driven operations?
Mangesh Pimpalkhare, SVP and GM of Splunk Platform at Splunk, explains that the modern enterprise spans physical buildings, cloud environments, distributed workforces, and an expanding layer of AI agents operating alongside human teams. Pulling all telemetry signals into one central location is not feasible at that scale. Instead, Splunk’s approach is a distributed architecture that delivers intelligence and context wherever activity is happening, whether that activity is human or agentic.
“You can’t really have a feasible solution where all the telemetry signals, all the intelligence and context on top of it comes in one central place. You need a distributed solution.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: What is Splunk’s machine data lake and how does it provide unified visibility without centralizing data?
Pimpalkhare describes the machine data lake not as a physical repository but as a virtual data lake: a unified catalog of wherever data already resides, covering what is in Splunk and what is in other systems. This forms the foundational layer on top of which Splunk’s context models and agentic workflows operate. The approach preserves data locality while giving AI agents a consistent, queryable view across the entire enterprise data surface.
“Think of that data lake as a virtual data lake, a unified catalog of wherever the data lives, with unified visibility of what data is in Splunk and what data is in other systems.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: What is Splunk AI Tier and how does it differ from the Cisco AI Pod?
Pimpalkhare draws a clear line between two on-premises delivery options. The Cisco AI Pod is a bundled hardware and software solution that combines Splunk’s AI capabilities with Cisco UCS servers, giving customers a turnkey deployment. AI Tier is the software-only package that lets customers run Splunk AI workloads, including AI assistants, Splunk agents, and the platform’s foundation models, on infrastructure of their own choosing, with Nvidia GPUs as a qualified and partner-supported option.
“AI Tier gives customers the software package but allows them to run it on an infrastructure of their choice. We have qualified hardware, for example Nvidia GPUs, and customers can run all that on Nvidia GPUs.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: How do Splunk’s domain-specific foundation models differ from frontier LLMs and why does the distinction matter for operational use cases?
Pimpalkhare positions Splunk’s foundation models, including time series models and log reasoning models, as complementary to frontier LLMs rather than competitive with them. Frontier models are trained on broad data up to a fixed point in time and lack the current operational context of any specific enterprise. Splunk’s domain models are fine-tuned on machine data and translate live telemetry into dense context that gets passed to the LLM, enabling faster and cheaper answers on operational questions.
“Think of it as a brain but without the entire memory. The context that we need to give this very powerful brain needs to take the operational context that’s in the machine data and make sense of that and pass that to the large language model.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: What are the measured performance and cost advantages of combining a log reasoning model with an LLM compared to using an LLM alone on log data?
Pimpalkhare cites internal benchmark results from running an LLM directly against large volumes of log data to diagnose failing systems. The LLM alone consumed a large context window, ran out of capacity, and burned significant tokens. When the same task was run with Splunk’s log reasoning model handling the domain-specific interpretation and passing condensed context to the LLM, the result was ten times faster execution at one-tenth the token spend.
“You get results 10 times as fast, but also at 1/10th the token spend. You actually achieve better speed and better cost by working with a large language model combined with a domain specific model, then combined with the operational telemetry.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: What is Agent Launchpad and what problem does it solve for practitioners building agentic workflows on operational data?
Agent Launchpad is part of Splunk’s AI toolkit and provides a structured way to author agentic workflows using markdown descriptions that define what the agent does, which ensemble of models it uses, which tool sets and destination systems it can access via MCP interfaces, and what governance guardrails apply, including token spend limits. Pimpalkhare positions it as purpose-built for operational use cases rather than a general-purpose orchestration framework.
“Agent Launchpad allows customers to author an agentic workflow with the workflow of what models are used, what tool sets are used, and the right governance saying what can the agent access or not access.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: How does Agent Launchpad differ from general-purpose agent orchestration frameworks like Claude or Codex?
Pimpalkhare explains that Agent Launchpad has out-of-the-box access to Splunk and Cisco’s foundation models and to the operational telemetry in the machine data lake, making it faster and simpler to configure agents for specific operational tasks such as continuous Kubernetes cluster health monitoring. For teams using general-purpose frameworks like Claude or Codex, Splunk exposes its platform capabilities through MCP interfaces so those orchestrators can consume the same foundation models and telemetry context.
“This is more agent orchestration framework specifically for operational use cases. If you have a general purpose agent orchestration solution like Claude or Codex, we can work with that too because we expose the capabilities of the platform through MCP interfaces.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: What steps should enterprises take to make their data ready for the agentic shift?
Pimpalkhare argues that data gaps predate AI and have simply become more consequential. Most enterprises sample only a small fraction of their machine data spectrum for observability and security purposes, and AI agents working on incomplete data cannot reach accurate answers at speed. He recommends building a comprehensive data strategy tied directly to the outcomes being driven and the cost of driving them sustainably, and then planning for continuous model retraining and workflow readjustment as operational conditions evolve.
“If you start ignoring large amounts of data, the AI is not going to be able to get to the right answers very quickly. Having a comprehensive data strategy makes a lot of sense, and you can only have a comprehensive strategy if you think of what outcomes you’re driving and how you’re going to drive those outcomes cost efficiently.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: How is the industry metric for AI usage shifting from token volume to value per token spent?
Pimpalkhare describes a measurable shift in how enterprises evaluate AI investments. A year ago the dominant metric was token consumption and raw usage volume. That framing has given way to value per spend unit: what outcomes does a given amount of token spend actually produce. Splunk introduced the concept of tokenomics at its prior conference, anticipating this shift, and Pimpalkhare notes the Linux Foundation has since formalized a tokenomics foundation, signaling the concept is becoming an industry standard discipline.
“It’s value per spend unit that is really becoming important. Every enterprise is really concerned about what are the outcomes you’re driving for a certain amount of token spend.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Q: What role does Splunk expect to play as agentic AI matures across the enterprise?
Pimpalkhare frames Splunk’s long-term position as becoming the system of record for agentic activity in the enterprise, analogous to how certain vendors became the system of record in CRM and ERP. As agent use cases proliferate across vendors and platforms, the enterprise will need a common layer that tracks what every agent is doing, maintains lineage of sanctioned agents versus unauthorized agents operating outside guardrails, and provides the ability to detect, roll back, or stop unintended agentic consequences. Pimpalkhare argues that Splunk’s telemetry architecture, Cisco data fabric integration, and hybrid cloud and on-premises coverage position it to fill that role.
“How do we trace the lineage of sanctioned agents versus dark agents? Are you able to trace agent activity when it goes off the guardrails and can you roll that back or stop unintended consequences? You can only do all these things if you have a system of record.” — Mangesh Pimpalkhare, SVP and GM of Splunk Platform, Splunk
Resources & Documentation
- Splunk Platform, enterprise machine data lake, AI assistants, foundation models, and Agent Launchpad for agentic workflow governance
- Cisco AI Pod with UCS Servers, turnkey hardware and software solution combining Splunk AI capabilities on Cisco Unified Computing System infrastructure
- Nvidia AI Enterprise and GPU Infrastructure, qualified hardware platform for running Splunk AI Tier workloads on-premises
- Model Context Protocol (MCP), open interface standard used by Splunk to expose platform capabilities to external agent orchestration frameworks
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Hi, this is your Swapnil Bhartiya and we are here in Denver at Splunk and we have with us once again Mangesh Pimpalkhare, SVP and GM of Splunk Platform. Mangesh, first of all, it’s good to have you on the show.
Mangesh Pimpalkhare: Yeah, glad to be here.
Swapnil Bhartiya: It’s my pleasure to talk to you again. I mean, if you look at it, for years we have focused on moving data to the model, but then we hit the whole data gravity. Of course, sovereignty is there and most important, rising cost. Now you folks are kind of flipping that script by bringing intelligence directly to where the data already lives. Of course you have the new AI tier partnership with Nvidia, which could in a way redefine the whole architecture as well. To talk a bit about, before we get into this event, an announcement we can talk about. How do you look at bringing the horse to the lake or bringing the lake to the horse?
Mangesh Pimpalkhare: It’s an evolving question. What I mean by that is if you go back and before AI data volumes, when they were much lower and teams were operating on their own and trying to solve relatively self contained problems, and that’s why it made a lot of sense to look at data domains, for example, in the security space, differently maybe than some operational spaces. But if you look at the enterprise is a very complex environment now, spanning not just brick and mortar buildings, but what is happening on the cloud and what is happening with a workforce that’s no longer all in the same place. Now it gets even more complicated because the workforce is no longer just human teams, it’s AI agents and human teams and the workload is spread across extremely complex environment. You can’t really have a feasible solution to build a solution where all the telemetry signals, all the intelligence and context on top of it comes in one central place. And you need a distributed solution. You need this intelligence to look across activity, wherever it is happening, whether it’s human activity or agentic activity. So that’s how we look at it. We look at ultimately making sure customers are driving the right outcomes with agentic solutions working alongside their human teams. But we are looking at how do we power these solutions using economical data framework and that can lead to these actions at the right machine speed. So if you look at all those requirements, then it needs a very different architecture. So that is what is shaping the change from how Splunk used to work before to now how it’s working.
Swapnil Bhartiya: And if possible, can you just go a bit deeper into the whole AI tier and the partnership with Nvidia which is enabling this.
Mangesh Pimpalkhare: Think of it. Splunk at its core used to be an analytics engine. That means you collect all telemetry signals and you run search and analytics on that data. Then we built all these AI models that were fine tuned on the machine data. And we have built. We don’t do what frontier model companies do, we complement that right? So we build foundation models like time series model or log reasoning models. And these give much more granular context to the large language models so that you can get to answer very, very quickly. And these capabilities of course need GPUs and they need specialized hardware. And on the cloud this is readily available. But if you go to on prem environments then customers often want to control what kind of infrastructure they want to run it on. So that’s why we kind of have now a hardware and software solution. So for example, Cisco AI Pod combines all that Splunk does all the AI pieces and puts it on Cisco hardware. So UCS servers and gives customers turnkey solution. AI Tier that you asked about gives customers the software package but allows them to run it on an infrastructure of their choice. So we have qualified hardware, for example Nvidia GPUs, we are partnering with them as well. And customers can use AI Tier to run their AI workloads, meaning Splunk AI assistants, Splunk agents, the models that I talked about, they can run all that on Nvidia GPUs. Now with AI tier in general, it
Swapnil Bhartiya: was like one giant model will do everything. And also there’s also perception that more parameters means but bigger is not always bigger. We are kind of, if you look at you folks, also towards a mix of specialized domain specific AI. Talk a bit about how does Splunk platform, as you mentioned, the whole foundational layer and the time series frontier and orchestrate. So talk about how does it enable organizations to first of all being able to do what they were doing more efficiently, not in terms of performance, but also cost is also a big topic these days, but also without losing unified context or in a way start creating new silos.
Mangesh Pimpalkhare: Swapnil I agree with your framing that ultimately the frontier models continue to build some amazing intelligence that is very broadly trained and these models are extremely powerful. But at the same time, let’s say the last model was trained last week, right? Ultimately, each model that comes out, whatever the latest model from Anthropic or OpenAI still went through a training run and was released at a certain point in time. That model does not have the latest operational context of a particular enterprise. It does not know what is happening this very minute or these last few seconds. So think of it as it’s like a brain but without the entire memory, right? Think of that and the context that we need to give this very powerful brain. It needs to kind of take that operational context that’s in the machine data and then make sense of that and pass that context to the large language model. That way the large language model can answer these questions very, very quickly. So I’ll give you an example. We ran some benchmarks like using a large language model on a large amount of logs data and trying to diagnose what systems are failing. And it takes the large language model quite a large context window, right? It starts running out of context window, it burns too many tokens. Instead of that, if you make the large language model work with one of our log reasoning models, which is a small domain model, then you get results 10 times as fast. But also you get results at 1 10th the token spend, right? So you actually achieve better speed and better cost by working with like basically a large language model combined with a domain specific model, then combined with the operational telemetry.
Swapnil Bhartiya: If you look at traditionally the machine data used to be kind of looking backward. Dashboards, of course, past incident review, not what is happening right now, quarterly reports. Now in agentic world, that is not going to work. It is all real time. So talk a bit about how does it. We talked about last time also Cisco’s network, the unique position that you focused and physical footprint with of course Splunk’s data engine, the kind of foundation it creates to enable enterprises to have agents that can operate autonomously or as tools.
Mangesh Pimpalkhare: You’re right that ultimately it starts with a very solid data foundation. And that’s where this idea of not trying to centralize all the data, but instead having this unified view of data wherever it resides, having and we call it a machine data lake. But think of that data lake as a virtual data lake. So think of that being a unified catalog of wherever the data lives. And we have unified visibility of what data is in Splunk, what data is in other systems. And that forms the foundation right on top of that foundation. We then have the context, meaning all the log reasoning models that I talked about. We are also working on graph reasoning models and the layer above that. One of the exciting announcements we had was agent Launchpad. So that allows customers to author a genetic workflow. So you can start with hey, what does the agent do? And what ensemble of models do you want it to use? And ultimately what are the governance guardrails around it, such as token spend, et cetera. And then set up that agent. That agent will take advantage of the underlying models and underlying telemetry to do the tasks that you’ve assigned it.
Swapnil Bhartiya: Can you go a bit deeper into the scope of Agent Launchpad and how does it fit into the whole whether Cisco or Splunk’s existing.
Mangesh Pimpalkhare: Yeah, so Agent Launchpad is very much part of Splunk’s AI toolkit. And with that what customers can do is author agentic workflow. These are typical markdown descriptions and it can really give you the workflow of what models are used and what tool sets are used. For example, what end destination or systems are available. With the MCP interface, you can construct these kind of agentic workflows with the right governance saying what can the agent access or not access? So this is very specific. Now this doesn’t replace what Codex or Claude or other orchestration frameworks does. Again, what this is is a specific way of authoring agents that are working on operational use cases.
Swapnil Bhartiya: When we look at Launchpad, how is it different from other offerings, other harnesses, other governance models that are already available there?
Mangesh Pimpalkhare: It is more context specific. So this harness has already an out of the box access to all Splunk and Cisco’s foundation models that we talked about. As an example, it also has access to the telemetry that we talked about. So as I was saying, think of this as more agent orchestration framework specifically for these operational use cases, such as just making sure your Kubernetes clusters are up and running and you know what those clusters are, you’re already gathering the telemetry from them. You already have the context of what applications run on these clusters. And now you’re creating an agent to keep an eye on all these clusters 24, 7 without having a human team on it. That agent is much more easy for us to author and set up rather than using a general purpose tool. Now if you have a general purpose tool, if you have a general purpose agent orchestration solution like Claude or Codex, we can work with that too because we expose the capabilities of the platform through MCP interfaces.
Swapnil Bhartiya: Applications come and go, workloads infrastructure come and go. But data is what is very, very critical. And this data was created before all AI thing happened though. We are working on data, AI ready. But your agents are as good as it can talk to the data, it can extract that value from the data. So organizations who are kind of, of course watching this. And of course everybody is on the AI bandwagon, but they are getting their data prepared for AI agent. What are some of the first steps they should take to make their data ready for this agentic shift?
Mangesh Pimpalkhare: Even before AI like organizations have had big gaps in data, right? For example, very few enterprises keep their eyes from an observability standpoint or security standpoint on 100% of the machine data spectrum. They only sample a small amount and often large amounts of data are ignored. Well, this starts becoming even more complex if you start ignoring large amounts of data, then the AI is not going to be able to actually get to the right answers very quickly. So having a comprehensive data strategy makes a lot of sense. And you can only have a comprehensive strategy if you think of what output outcomes you’re driving and how you’re going to drive those outcomes cost efficiently. Because you know, if you can’t afford the comprehensive outcome and you just decide, hey, I’ll just look at 10% of my data, it won’t give you the answers that you might be looking for. So comprehensive data strategy, working about, thinking about costs, thinking about, are you able to drive machine speed solutions and then are you able to kind of keep up with retraining your models? Retraining, readjusting your workflows on a continuous basis. Those are the things enterprises should be thinking about.
Swapnil Bhartiya: When we talk about cost here, especially token cost is getting out of control and it’s become a very serious topic. Should we be more focused on taming the cost? Because that also limits our capability to use models, right? Because you have burned all those tokens, now you’re left with or when I was looking at a lot of things that you folks here doing is more about, not about bragging about. I burn 1 million tokens every day versus more about what value I get from it. So the focus is shifting from taming the cost versus what I’m getting from it. Because in the end that’s what if you remove all the shiny objects, everything that is hype. That is what businesses or individuals are focused on doing, right?
Mangesh Pimpalkhare: Yeah, absolutely. Swapnil, you had it right. It’s value per spend unit that is really becoming important. And we went through a phase a year ago when people used to talk about token maxing and hey, the metrics being how much usage you’re driving. But now the shift has already happened. Every enterprise is really concerned about what are the outcomes you’re driving for a certain amount of token spend. So efficiency is important, performance and efficiency is becoming super important and this is a big part of our focus. Swapnil, you might recall we started using the word tokenomics last conf right? And this was we are a little ahead of the curve. But soon, in the following few months the tide started shifting and now there’s no question every single enterprise really is looking at it through the same lens.
Swapnil Bhartiya: Now Linux Foundation also has a foundation in tokenomics foundation, so it’s kind of becoming a norm in the industry. If I ask you that, I don’t like to ask questions which are looking at the future, but where do you see Splunk platform’s role evolving as AI tier matures? As you also said, the whole tokenomics economy or culture evolves.
Mangesh Pimpalkhare: Where I see this going, we are very well positioned, I think, to become a new system of record of sorts for agentic activity in the enterprise. And what I mean by that is there is going to be a lot of different agent use cases and I don’t think there’s going to be a single vendor who’s going to solve all those problems. Clearly the ecosystem is going to solve different parts of it. That said, you cannot have many different foundational aspects because otherwise the solutions will get splintered and not have the right efficiency, the scale economy that we talked about. So I think the big opportunity for Splunk is to become that common system of record. So just as you saw a few companies emerging as the winners as the system of record in the CRM space or in the ERP space in the past years, I think with the advent of AI, you’re going to need new systems of record. What are all these agents doing? How do we trace the lineage of sanctioned agents versus dark agents? Are you able to trace agent activity when it goes off the guardrails? And can you roll that back eventually or stop unintended consequences from happening? You can only do all these things if you have a system of record. We are all figuring it out, but because of our strong telemetry architecture, because of all the changes we are making for the Cisco data fabric, all the AI pieces that we talked about, we are building on top of it. That’s why I believe we are pretty well positioned. And of course we also have a solution spanning cloud and on prem, as we discussed before.
Swapnil Bhartiya: Mangesh, thank you so much for once again joining me and sharing some great insights about data, of course the whole infrastructure, where the AI models are moving. And also thanks for sharing of course, about the whole Launchpad governance. Once again it was a very valuable discussion as usual, and I would love to have you back on the show. Thank you.
Mangesh Pimpalkhare: Fantastic. A pleasure.
Swapnil Bhartiya: Thank you so much.
Mangesh Pimpalkhare: Thanks.
