Cisco adds native Splunk data path
Cisco announced native Splunk integration for Data Center Networking that delivers real‑time dashboards and performance insights for multi‑client SIEM setups. Native telemetry pipelines can reduce mapping work during onboarding and help maintain tenant isolation while providing consistent dashboards. That makes it easier to show per‑tenant data‑source coverage and to include network signals in Zero Trust evidence packs. (Cisco announcement)
Most network outages start as tiny clues: a switch changes state at 2:00 p.m., packet delay jumps at 2:05 p.m., and the security team sees the alert in a different console five minutes later. Cisco’s new move is to put Splunk analytics inside its data center networking stack so those clues land in one place faster. (blogs.cisco.com) A data center network is the plumbing inside a company’s server room, and Cisco’s Nexus Dashboard is the control room for that plumbing. Cisco says the new setup runs Splunk capabilities directly in Nexus Dashboard instead of treating Splunk like a separate downstream tool. (cisco.com) The raw material here is telemetry, which is machine-generated status data like anomalies, advisories, audit logs, and health scores. Cisco says the native path streams that telemetry through Splunk’s Hypertext Transfer Protocol Event Collector so teams can analyze it in real time. (cisco.com) That changes where the work happens. Instead of shipping every log line to a central cloud first, Cisco says customers can process high-fidelity network data at the source, which cuts storage and data-transfer costs and keeps sensitive records on premises. (blogs.cisco.com) (cisco.com) Cisco is aiming this at companies that split one Splunk environment across multiple internal groups or external clients. In those multi-tenant security information and event management setups, tenant isolation means one customer’s network evidence has to stay separate from another customer’s dashboards and alerts. (cisco.com) The practical selling point is less onboarding work. Cisco’s Data Center Networking app on Splunkbase says it ships with default data models, prebuilt dashboards, and visualizations for Cisco Nexus 9000 switches, Application Centric Infrastructure, and Nexus Dashboard, which means teams spend less time mapping fields before they can search and report. (splunkbase.splunk.com) Cisco is also filling in a gap it has been talking about since buying Splunk for $28 billion in March 2024. Network World reported on March 10, 2026 that Cisco was blending Splunk technology into Nexus Dashboard for data center and campus observability, turning the acquisition into something customers can actually use inside day-to-day operations. (crn.com) (networkworld.com) The data center piece matters because older Cisco-Splunk content packs focused first on campus and branch networks. Splunk said in March 2026 that its new Information Technology Service Intelligence content pack for Cisco Data Center Networking was the “missing link,” because the data center is where application traffic, east-west server traffic, and most troubleshooting pain actually live. (splunk.com) Cisco says the native Splunk feature is available for customers with Data Center Networking Premier licensing on Nexus Dashboard, with the full native capability sold as an add-on license. That makes this less like a free connector update and more like a new paid layer in Cisco’s push to make Nexus One the operating system for modern data center networks. (cisco.com) What Cisco is really selling is a shorter line between a network change and a security answer. If a customer needs a Zero Trust evidence pack, or just proof that one tenant’s data sources are covered and isolated from another’s, Cisco now wants that proof to come straight from the network control plane instead of a pile of custom integrations. (blogs.cisco.com)
