Cisco amped Splunk observability powers to provide enterprise AI usage visibility, as utilizing spoils from its recent Galileo acquisition.
Splunk Agent Observability was expanded to provide tokenomics tracking within both Splunk Observability Cloud and Cisco Cloud Control. The capability provides visibility into AI coding tools like Claude Code and Codex, allowing users to track usage, costs, and productivity by team or user, and combine spend across different vendors in one view. The Cisco Deep Time Series Model (CDTSM) tool also predicts final billing before the cycle ends.
Kamal Hathi, SVP and GM for Splunk, explained in a preview on the news and tied to this week's Splunk Conf26 event that AI costs were becoming critical for customers.
“So what we are doing now is we're delivering a solution to optimize your AI token spend, what you call tokenomics, and we are able to integrate tokenomics both in terms of managing the consumption of tokens, but also controlling actively controlling those costs, and we can align these token usage with business priorities, and we get full visibility attribution into token usage, and then prescriptive tools to optimize spend without sacrificing quality," Hathi said.
Splunk is spearheading Cisco's push into the tokenomics space, adding onto talk from Cisco Chief Product Officer Jeetu Patel at June’s Live 2026 event. While Patel noted the market then was still in early phases, he saw Cisco as pinning its flag to the agentic mast with its Galileo acquisition to help analyze agents down to the behavioral level. Splunk layers model and graphic processing unit (GPU) to assess performance and gauge the exact token count for AI actions.
Hathi claimed all his conversations with clients raised the AI token “tax,” implying some market movement since the summer.
Galileo meets Splunk #
The token aspect comes as a by-product of the agentic pane of glass offered in Splunk, with Agent Observability generally evaluating agent behavior and performance across a firm’s entire AI stack, while guardrailing agents in real-time to prevent harmful actions and outputs.
Vikram Chatterji, senior director for agent resilience at Splunk and former Galileo CEO, touted a deft integration of these various metrics, commenting: "The way we've thought through this is it should be the least amount of intrusion for our customers ... it's a very low-lift integration with each of these different third-party systems that we've heard from our customers take up most of the tokens.”
As noted by this title at the time, Hathi framed the Galileo deal as safeguarding AI agents to help ensure “a foundation of transparency and accuracy.”
This extends to the growing notion of sovereign AI, which was talked up by Cisco in tandem with tokens at this year’s Mobile World Congress (MWC) event in Barcelona, Spain.
Hathi argued sovereignty was a “very important piece” that would now be better tracked through Splunk observability.
“To make sure that you know these kinds of sovereign solutions have the same insights and ability, and they can compare costs between what is running ... I would say on local infrastructure versus cloud infrastructure and frontier models,” Hathi said.
Elsewhere at Splunk Conf26 #
Splunk also introduced an Observability Studio for shift-left app development, ensuring each new application is measurable and operationally ready from launch via OpenTelemetry-compliant instrumentation.
Network Intelligence App, meanwhile, brings Cisco network topology, device health, and events into the Splunk suite, which Hathi said would help network teams "unlock the insights of the data and work on the problems that are described."
Splunk Observability Cloud also now comes with a free tier providing full-stack observability for small environments, while a Simplified Editions version focuses on core observability use cases designed for teams getting started as opposed to the Premier edition, which is designed for teams already building AI agents at scale and need more capabilities. Both editions include Splunk Agent Observability, APM, Infrastructure Monitoring, and Observability Logs.