Splunk
Splunk is Cisco's $28B security and log-analytics platform, now folded into Cisco's networking stack.
On the record
Checkpoint: Cisco Q4 FY2026 earnings, testing whether Security segment reaccelerates as promised
The call
Splunk sits inside Cisco with strong lock-in but shrinking headcount, flat security revenue, and Microsoft Sentinel gaining ground on the edges.
Splunk helps companies find and fix problems in their computer systems by analyzing logs and data. It has real advantages: two decades of built-in detection rules, government security certifications, and tight integration with Cisco hardware, making it expensive and risky to replace. However, three live problems create doubt: Microsoft is shipping a competing product that is winning deals, Splunk's headcount shrank 9% with almost no new hiring, and Cisco's own bosses said the security division's revenue has been flat or down for three straight quarters even though they claim growth underneath. The picture could change sharply at Cisco's August earnings call, which will reveal whether Splunk actually gets investment or absorbs cuts instead.
Why
01
AI pressure: Microsoft Sentinel. Sentinel's AI-driven detection wins new deals and pressures Splunk's per-GB pricing, though it hasn't proven displacement in existing accounts yet. Could AI do the core job? Unlikely.
02
Bigger players: Cisco itself. Cisco's $1B restructuring redirects spend toward silicon, optics and AI while Security revenue sits flat for three straight quarters. Could a giant copy it? No, they are blocked.
03
What protects it. FedRAMP certs, two decades of SPL detection content, and Cisco hardware bundling keep enterprises locked into Splunk's data.
What would change this call
Cisco Q4 FY2026 earnings (mid-August 2026) Security segment growth rate. Whether Splunk's business inside Cisco is reaccelerating or still stagnant.
Splunk-specific headcount or hiring changes reported in next two quarters. Whether Cisco's $1B restructuring toward 'silicon, optics, security, AI' cuts or grows Splunk.
Reports of Microsoft Sentinel replacing Splunk inside existing large enterprise accounts. Whether Sentinel is taking installed customers, not just new greenfield deals.
Splunk-specific headcount or hiring changes reported in next two quarters. Whether Cisco's $1B restructuring toward 'silicon, optics, security, AI' cuts or grows Splunk.
Reports of Microsoft Sentinel replacing Splunk inside existing large enterprise accounts. Whether Sentinel is taking installed customers, not just new greenfield deals.
Key numbers
- $28B Cisco acquisition closed
- Security revenue flat y/y at ~$2B
- Job postings fell from 759 to 55
Named risks
- Cisco's $1B May 2026 restructuring toward silicon, optics, security, AI could absorb Splunk-specific budget or headcount.
- Security segment revenue flat-to-down for three consecutive quarters through May 2026 despite claimed double-digit ARR growth.
- Microsoft Sentinel gaining share as a fast-rising SIEM challenger bundled into Azure/M365.
- Hiring has nearly stopped, job postings down from 759 to 55 between 2024 and 2025.
- Multiple Observability Cloud reliability incidents through mid-2026 could erode customer trust during heavy AI feature rollout.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Microsoft Sentinel | gaining on | Described as 'fast-rising' SIEM challenger bundled into Azure/M365, as of June 25, 2026 |
| OpenObserve | contesting | Claims 60-90% cost savings vs Splunk in commodity log-ingest pricing, July 6, 2026 |
| Datadog | contesting | Named peer competitor in observability/APM/log analytics as of April 24, 2026 |
| Elastic | contesting | Competes in SIEM and observability with open-source-flavored positioning, June 25, 2026 |
| AWS CloudWatch | contesting | Hyperscaler-embedded observability competitor cited April 24, 2026 |
Questions people ask
- Is Splunk profitable in 2026?
- Splunk no longer reports standalone financials since becoming a Cisco subsidiary on March 18, 2024. Cisco's Security segment containing Splunk reported flat revenue of about $2 billion year over year as of Q3 FY2026 (May 28, 2026), with management attributing this to an on-prem-to-cloud transition, not underlying weakness.
- Is Splunk owned by Cisco?
- Yes. Cisco Systems completed a $28 billion all-cash acquisition of Splunk on March 18, 2024, making it a wholly owned subsidiary now branded 'Splunk, a Cisco company' in public communications as of June 2026.
- Is joining Splunk safe right now, given Cisco layoffs?
- Risk is elevated but not confirmed Splunk-specific. Splunk LLC headcount fell to about 5,696 by December 2025, down 9.1% from 2023, and job postings collapsed from 759 in 2024 to 55 in 2025. Cisco's May 13, 2026 $1 billion restructuring targets 'silicon, optics, security, AI' broadly.
- Could AI replace Splunk's SOC analyst functions?
- AI is automating tier-1 alert triage and detection-rule writing, and Splunk itself shipped Detection Builder Agent, Triage Agent, and AI SRE (GA late June 2026) to automate these workflows, but Splunk positions itself as the AI feeding on proprietary log data rather than being displaced by it.
- Who is Splunk's biggest competitor?
- Microsoft Sentinel is described as a 'fast-rising' SIEM challenger as of June 25, 2026, bundled directly into Azure and Microsoft 365 for distribution advantage; Datadog, Dynatrace, Elastic, and cost-disruptive entrants like OpenObserve also compete in observability and log analytics.
- Is Splunk's revenue growing or shrinking under Cisco?
- Cisco's Security segment, which includes Splunk, was flat year over year at roughly $2 billion as of Q3 FY2026 (May 28, 2026), following a 2% decline in Q1 FY2026 (November 12, 2025); Cisco says this reflects a cloud-subscription transition while Splunk ARR and RPO grew double digits underneath.
Timeline
- 2026-06-18Cisco announces WideField Security acquisition, third AI-security deal in ~10 weeks
- 2026-06-02Cisco Live: launches Agentic SOC agents, AI SRE GA, and Cisco Data Fabric powered by Splunk
- 2026-05-28Cisco Q3 FY2026: Security revenue flat y/y at ~$2 billion, on-prem-to-cloud drag cited
- 2026-05-13Cisco announces up to $1 billion restructuring toward silicon, optics, security, AI
- 2026-05-04Cisco/Splunk announces Astrix Security acquisition
- 2026-04-09Cisco announces Galileo Technologies acquisition for AI-agent observability
- 2026-03-10Cisco integrates Splunk ITSI into Nexus Dashboard for fault detection
- 2025-11-12Cisco Q1 FY2026: Security revenue down 2% y/y, Splunk ARR/RPO said to grow double digits
- 2025-02-12Cisco Q2 FY2025: Security revenue up 117% y/y driven by Splunk consolidation
- 2024-03-18Cisco completes $28 billion all-cash acquisition of Splunk
Revision history
21 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Splunk
- Cisco Reports Second Quarter Earnings (2025-02-12)
- Cisco Systems Inc (CSCO) Q1 2026 Earnings Call Highlights (2025-11-12)
- Cisco's Security Revenue Growth Set to Pick Up (2026-05-28)
- Splunk Cuts Its Workforce About 4 Percent (2023-02-02)
- Splunk Number of Employees 2026 (2026-06-29)
- Splunk cuts 7% of workforce ahead of Cisco acquisition (2023-11-01)
- Cisco (CSCO) Q3 2026 Earnings Transcript (2026-05-14)
- Cisco blends Splunk analytics, security with core data center management (2026-03-10)
- Acquisitions by Year (2026-06-19)
- OpenObserve, Elastic, Grafana & Datadog (2026-07-06)
- Splunk Observability Cloud US0 Incident History (2026-07-15)