Enterprise APM inside Splunk.
On the OpenTelemetry data you already have.
Inno Observability turns OpenTelemetry traces in your Splunk index into a complete APM console: transactions you can watch while they are still running, a trace waterfall that shows the actual bound SQL parameters, service topology, Kubernetes deployment history that survives a rollback, collector fleet management, a self-service chart studio, and AI root-cause analysis driven by your own LLM. It reads the data you already collect and runs entirely inside your own Splunk deployment.
Everything included — one licence, every feature · OpenTelemetry-native, no vendor agent · Live in-flight transactions · Bound SQL with no application code change · Kubernetes rollback evidence · AI RCA on your own LLM · Offline node-locked licensing, air-gap friendly · Free demo on Splunkbase — buy through your Splunk partner or directly from us · Actively developed — new features ship continuously
See pricing Talk to us first📧 How you get it
Start free, from Splunkbase. Download Inno Observability from Splunkbase and install it like any other Splunk app. Without a licence key it runs in demo mode: every screen is populated with example data so you can see exactly what the product does — with the Service Map as the deliberate exception, which queries your own environment so your own service names appear on it.
When you buy — through your Splunk partner or from us — we email you an installer package built for your deployment. It contains your RSA-signed licence key, already node-locked to the Deployment ID you gave us, and the licensed server-side components. Installation is one command on your search head; on a search head cluster you run the same command once per member. It is idempotent — re-running it upgrades in place — and it needs no internet access, so air-gapped sites install exactly like connected ones. The installer verifies itself and tells you whether the licence came up.
You keep the app you already installed. There is no second
.spl to swap in, and nothing you built — saved charts, dashboards, layouts — is
disturbed.
On-premises Splunk Enterprise today. The licensed components run as a compiled service on your search head — that is how the product's core logic stays out of the shipped package — and Splunk Cloud does not allow installing one. Splunk Cloud support is planned; if that is your platform, tell us and we will let you know when it lands.
What it does
Transactions you can watch mid-flight
Most trace tooling can only show you a request after it finished. A span-lifecycle emitter reports started and ended separately, so the active-transaction cylinder shows requests that are still running right now — the same view an APM operator expects when something is hanging.
Bound SQL — the real parameter values
A trace that shows WHERE id = ? tells you nothing about which query
was slow. An OpenTelemetry agent extension instruments the JDBC calls at bytecode level and
attaches the bound values to the DB span — no application code
change, and driver-independent. Python services are covered through the DBAPI
instrumentation hook.
Kubernetes rollback evidence
A bad deploy gets rolled back, the ReplicaSet disappears, and the configuration that caused the incident is gone before anyone can look at it. A ledger records every configuration version as it happens — image, env, resources, and ConfigMap contents — so the offending version is still there after the rollback.
Trace waterfall with the context around it
Open a trace and get the full span waterfall, the correlated application logs, the infrastructure and runtime metrics for the window, and the bound SQL — on one screen, instead of four tabs and a copy-pasted trace id.
Kubernetes, correlated
Cluster → namespace → workload → pod, with metrics, APM latency and error rate, log
errors and cluster events in one quadrant view. Node and capacity screens surface the
request/limit commitment that usually only shows up as a FailedScheduling at
3 a.m.
OpenTelemetry-native
Nothing of ours runs on the systems you monitor. If your services already emit OTel traces into Splunk, the app reads them. Collector configuration is standard, and a generator produces the install commands for VM and Kubernetes rollouts.
AI root-cause analysis — on your LLM, not ours
Ask the app to explain an incident and it assembles the evidence — the golden signals for the window, the slowest and failing traces, the span waterfall, the bound SQL, the correlated error logs, the recent deployments and restarts, and the same window one week earlier — then has a language model reason over it and name a root cause, citing the trace ids, SQL and log lines it used.
Your data never leaves your control.
The analysis runs through your own LLM connection — either a model you reach from Splunk's AI Toolkit, or an external endpoint you host. We do not run a model, do not proxy the request, and never see your telemetry. There is no per-token charge from us, and no vendor model to trust with production traces.
This also means you must have a model available. See the FAQ before purchasing if you are not sure what you would connect it to — everything else in the product works without one.
What's included
One licence, every feature. There is no edition ladder and nothing held back for an upsell — if it is in the product, it is in your licence.
Application performance
- Overview — golden signals with day-over-day deltas and deployment markers, live active-transaction cylinder, DB call latency and slow-call counts, error log and recent-change feed
- Service Map — service topology with health, dependencies and per-node drill-down
- Trace Scatter (X-View) — response-time distribution across the window, click any point to open that trace
- Service Detail — per-endpoint RED metrics, Apdex, slow and error trace lists, error patterns, per-instance breakdown, JVM and Python runtime metrics
- Trace List & Trace View — searchable trace inventory, full span waterfall, bound SQL, correlated application logs, infrastructure metrics for the trace window
Kubernetes
- One-View — cluster → namespace → workload → pod hierarchy with a four-quadrant correlation of metrics, APM, logs and events
- Cluster & node detail — request/limit commitment, resource efficiency and idle waste, node conditions, pod density, persistent volume usage, control plane health, pod honeycomb
- Deployment timeline — every configuration version as an immutable record, with the rolled-back version and a version-to-version configuration diff
- Works on managed and self-managed clusters alike — EKS, AKS, GKE and on-premises
Infrastructure & agents
- Fleet Map — infrastructure honeycomb grouped by category and severity
- Server list & detail — inventory, liveness, load, storage, role processes
- Server classification — automatic role detection with an admin console for rules and overrides
- Agent Manager — collector fleet health from the collectors' own telemetry, inventory, per-node detail, and an install-command generator for VM and Kubernetes rollouts
- System Events — OS reboot, collector restart and crash timeline across the fleet, distinguished from one another rather than lumped together
Build your own
- Chart Studio — write SPL, get a themed chart with synchronised crosshairs and threshold colouring, save it, assemble dashboards by drag-and-drop, add filter bars and chart-to-chart deep links
- Publish to any app — a Studio dashboard can be published as a normal Splunk view in whichever app you choose, self-contained, with an edit deep link back
- Layout editor — rearrange the built-in dashboards themselves and save the layout for everyone
AI
- Incident analysis — evidence-backed root cause citing trace ids, SQL and log lines, using a model you connect
- Two integration modes — a single well-formed call through Splunk's AI Toolkit, or an external endpoint you host for multi-step investigation
- Asynchronous — analysis runs in the background; close the window and the result is waiting when you return
🚀 Actively developed — and updates are included
This product ships new capability continuously. Kubernetes deployment ledgers, node and capacity analysis, collector fleet management, the chart studio and AI root-cause analysis were all added after the first release, and the roadmap keeps going.
Every feature we release during your licence term is included at no extra cost — there is no upgrade fee, no new edition to move up to, and no feature that arrives locked. When we ship, you get it.
Building something for your environment that is not here yet? Tell us — a lot of what shipped this year started as a customer asking.
Licensing
Offline — no phone-home
Keys are RSA-signed and verified locally by the app. Nothing contacts a licence server, so air-gapped and network-restricted deployments work exactly like connected ones.
Locked to your Splunk deployment
A key is issued against your Deployment ID — your Splunk deployment's own identifier. It unlocks that deployment and no other.
DR and standby covered
A key can carry a second Deployment ID for your DR site. If you don't know it when you order — most people don't — leave it blank and email us later. Adding it is free and does not shorten your term.
Unlimited scale
No per-host, per-service, per-GB or per-trace metering. Monitor 30 hosts or 3,000 for the same licence fee. Your Splunk indexing tier is the only thing that scales with volume, and that is a bill you already have.
| rest /services/server/info | eval deployment_id=coalesce(manager_guid, master_guid, guid) | table deployment_id
It returns a single value that looks like
ED2C6866-42DE-4179-8198-5FC1DE050707. That is what we need.
Not sure which instance to run it on? Ask us before you buy — a key
issued for the wrong deployment will not unlock anything.
Pricing
A fixed licence fee plus your partner's technical support. That is the whole price.
Your price has two parts: a fixed licence fee per Splunk deployment, and the technical support fee of the partner who installs and supports the product for you. Neither is metered. Adding hosts, network devices, services, clusters or data volume does not raise what you pay — monitor 30 hosts or 3,000 at the same price — and every feature released during your term is included.
Licence fee — fixed
- Every feature — nothing held back
- Unlimited hosts, devices, services and search window
- All new features released during the term
- Node-locked to your deployment (plus a DR deployment, free)
Technical support — from your partner
- Installation of the collector, add-on and server-side components
- Configuration for your environment
- First-line technical support
- Backed by Inno Software product support
How to buy
Through an authorized Splunk partner
Ask the partner that already supplies or supports your Splunk. They quote the licence and their technical support together and handle your purchase order and invoicing. If your partner has not sold Inno Observability before, they can reach us at support@innosw.net and we will set them up.
Or directly from Inno Software
Email support@innosw.net with "Sales" in the subject line. We will quote you directly or introduce a partner who can install and support it in your environment.
Either way, include your Deployment ID (see above) — the licence is issued against it. Prices are provided on quotation and are not published.
splunkd.log), the app's own logs and the
server-side component's service log, and the output of diagnostic searches we send you.
The product has no remote access and no phone-home, so this is the only way we can see what
went wrong; if the requested information is not provided, we may be unable to diagnose or
resolve the issue. Remove passwords, tokens and keys before sending — we will never ask for
them. See Terms §11.
FAQ
How do I get the app and my licence key after ordering?
The app itself comes from Splunkbase and is free to install — you can have it running in demo mode before you buy. Once your order is confirmed we email your installer package, which carries your node-locked licence key and the licensed server-side components, with a one-line install command for your search head. If it isn't in your inbox, check your spam/junk folder — it comes from support@innosw.net. You can always email us and we'll resend it.
Where do I buy it, and how much is it?
Through an authorized Splunk partner, or directly from Inno Software — see Pricing. The price is a fixed licence fee per Splunk deployment plus your partner's technical support fee, provided on quotation. It does not grow with the number of hosts or devices you monitor.
What do I need to provide to get technical support?
The logs and Splunk information we ask for — typically versions, deployment topology, Splunk internal logs, the app and server-side component logs, and the output of diagnostic searches we send. The product never connects back to us, so without them we cannot see the problem. Strip passwords, tokens and keys first; we never ask for them.
Can I evaluate it before buying?
Yes — ask us for an evaluation licence and tell us a little about your environment. We would rather you prove it works on your own traces than take your money and find out afterwards that your data isn't shaped the way the product expects.
What data does the app need?
OpenTelemetry spans in a Splunk index. Point the apm_index macro at it and the
APM screens work. The Kubernetes screens additionally use the metrics, objects, events and
container logs that the standard Splunk OpenTelemetry Collector chart already sends. The
infrastructure and agent screens use host metrics and collector self-telemetry from the same
collector.
Do I need a special agent?
No. Standard OpenTelemetry instrumentation and the standard Splunk OTel Collector are enough. Two optional agent extensions add capabilities plain OTel does not have — bound SQL parameters and span-lifecycle events for live in-flight transactions — and both attach to the existing OpenTelemetry Java agent without touching your application code.
Where do I find my Deployment ID?
Run the search shown in the Licensing section above. It returns a single identifier. On a distributed deployment, run it on your license manager; on a standalone instance, run it there. If you are unsure, send us the output from both and we will tell you which one to use.
What if my Deployment ID changes?
Email us and we reissue the key at no cost, keeping your remaining term. This happens legitimately — DR failover, hardware replacement, a rebuilt search head — and we would rather reissue than have you blocked. For planned redundancy, ask us to put both deployments on the key up front.
Does the licence need internet access?
No. Verification is fully offline against a signature. Air-gapped environments are a first-class case, not an afterthought.
What do I need for the AI root-cause analysis?
A language model you can reach. Either configure a connection in Splunk's AI Toolkit and the app calls it with a single well-formed prompt, or point the app at an external LLM endpoint you host, in which case it can perform multi-step investigation. We do not supply a model. Everything else in the product works without one, so treat it as a capability you can switch on whenever a model becomes available to you.
How long does an analysis take?
It depends entirely on the model you connect. On a self-hosted 27 B reasoning model on a single GPU we measure roughly three to six minutes per analysis; hosted models are considerably faster. The app runs it in the background — you can close the window and the result is waiting when you come back.
Which Splunk versions are supported?
Splunk Enterprise 9.x and 10.x, on Python 3. Licence enforcement runs server-side as a Splunk custom search command, so it behaves correctly for non-admin roles as well.
Splunk Cloud is not supported yet. The licensed features are delivered as a compiled service that installs on your search head — this is deliberate, and it is what keeps the product's core logic from shipping as readable source. Splunk Cloud does not allow installing such a service, so the licensed features cannot run there today; demonstration mode is unaffected. Cloud support is on our roadmap. If you are on Splunk Cloud, tell us — we would rather say so before you buy than after, and it helps us prioritise.
Are new features extra?
No. Everything we release during your licence term is included — no upgrade fee, no new edition, no feature that arrives locked. The product is under active development and that is part of what the licence buys.
What happens when the licence expires?
The application reverts to demonstration mode — the same state it is in before a licence is entered. Screens keep opening, but they show generated example data instead of your own, and they are labelled as such. It does not delete anything, does not stop your Splunk deployment, and does not interfere with your environment in any other way — all the data it was reading is your own Splunk data and it stays exactly where it is. Enter a valid licence and every screen returns to your real data.
Is my telemetry sent anywhere?
No. The app is a set of Splunk dashboards and search commands that run inside your own Splunk deployment. Nothing is transmitted to us — there is no phone-home, no usage reporting, and no proxy. The only outbound call the app can make is to the LLM endpoint you configure for root-cause analysis.