Splunk Cloud Outage History

Splunk Cloud environments with ITSI experienced rolling restarts following maintenance activities, affecting login, ingest, search, and index components across multiple platform types including FedRAMP environments. Customers observed restart notifications, reload prompts, and intermittent search disruptions during the 53.6-hour incident. The issue was resolved after coordinating remaining restart activities to occur at midnight local time in each cloud provider region to minimize customer impact.

A DNS synchronization issue affected Splunk Cloud customers using the dash-format HEC endpoint (http-inputs-${stack}.splunkcloud.com), causing data ingestion problems for 1 hour. Customers experienced ingestion failures while the dot-format endpoint (http-inputs.${stack}.splunkcloud.com) continued to work normally. The issue was resolved through DNS zone synchronization, and customers were advised to migrate to the dot-format endpoint as a permanent solution.

Splunk Cloud customers in ap-northeast-1, eu-central-1, and us-east-1 regions experienced data ingestion issues through AWS PrivateLink due to an internal configuration change that began impacting service at 20:34 UTC on May 27, 2026. The incident affected the ability to receive HEC (HTTP Event Collector) data and caused general access issues for customers in these regions. The issue was resolved after 1.5 hours when engineering teams developed and deployed a fix, with full remediation completed by 03:45 UTC on May 28, 2026.

Splunk Cloud experienced a major outage lasting 61.6 hours due to a network connectivity issue with a third-party supplier in the us-east-1 region, making the platform inaccessible for a limited number of customers. The incident affected core components including Ingest, Search, and Index functionality. Recovery was gradual with most environments restored progressively, and the issue was fully resolved after teams worked with the supplier to implement mitigation efforts.

Splunk Cloud experienced a major search outage lasting 2.4 hours, beginning at 16:34 UTC, that caused degraded search performance and intermittent UI errors. Engineering teams identified the root cause and implemented a fix, with service recovery observed for the majority of customers before full resolution. The incident was fully resolved at 20:41 UTC after continued monitoring to ensure all services returned to normal operation.

Splunk Cloud experienced a major internal IT service disruption that affected core functionality including login, data ingestion, search capabilities, and indexing for 6.3 hours. All planned maintenance activities were paused or canceled during the incident. The service was stabilized after monitoring and fully resolved.

A KVservice issue in Splunk Cloud impacted Enterprise Security search performance for 1.3 hours, affecting ad-hoc, saved, and scheduled searches, particularly those using lookup commands for KV collections. Users experienced inability to save searches within the ES application, errors updating application settings like credentials, and failures in Mission Control and Analyst Queue dashboards. The engineering team identified the root cause and successfully implemented a fix, restoring full operational status to all searches and dashboards.

A cloud service provider outage in the Middle East region affected Splunk Cloud customers' ability to login, search data, and ingest new data for over 3 weeks. Cisco engineers resolved the issue by transitioning affected services out of the impacted region. All affected customers were contacted individually with specific remediation steps through proactive support cases.