Enterprise APM inside Splunk.
On the OpenTelemetry data you already have.
Inno Observability turns OpenTelemetry traces in your Splunk index into a complete APM console: transactions you can watch while they are still running, a trace waterfall that shows the actual bound SQL parameters, service topology, Kubernetes deployment history that survives a rollback, collector fleet management, a self-service chart studio, and AI root-cause analysis driven by your own LLM. No proprietary agent, no data leaving your environment, no second observability platform to buy and operate.
Everything included — one licence, every feature · OpenTelemetry-native, no vendor agent · Live in-flight transactions · Bound SQL with no application code change · Kubernetes rollback evidence · AI RCA on your own LLM · Offline node-locked licensing, air-gap friendly · Download link and licence key emailed on purchase · Actively developed — new features ship continuously
See pricing Talk to us first📧 How you receive it
The moment your payment completes, we email the address you used at checkout with both:
- The application download link — the installable Splunk app package
(
.spl), with step-by-step install instructions - Your licence key — already node-locked to the Splunk deployment you entered at checkout, ready to paste into the app's License screen
No support ticket, no manual step, no waiting on a human. The email is sent the instant the payment clears and normally reaches you within a few minutes, from support@innosw.net.
What it does
Transactions you can watch mid-flight
Most trace tooling can only show you a request after it finished. A span-lifecycle emitter reports started and ended separately, so the active-transaction cylinder shows requests that are still running right now — the same view an APM operator expects when something is hanging.
Bound SQL — the real parameter values
A trace that shows WHERE id = ? tells you nothing about which query
was slow. An OpenTelemetry agent extension instruments the JDBC calls at bytecode level and
attaches the bound values to the DB span — no application code
change, and driver-independent. Python services are covered through the DBAPI
instrumentation hook.
Kubernetes rollback evidence
A bad deploy gets rolled back, the ReplicaSet disappears, and the configuration that caused the incident is gone before anyone can look at it. A ledger records every configuration version as it happens — image, env, resources, and ConfigMap contents — so the offending version is still there after the rollback.
Trace waterfall with the context around it
Open a trace and get the full span waterfall, the correlated application logs, the infrastructure and runtime metrics for the window, and the bound SQL — on one screen, instead of four tabs and a copy-pasted trace id.
Kubernetes, correlated
Cluster → namespace → workload → pod, with metrics, APM latency and error rate, log
errors and cluster events in one quadrant view. Node and capacity screens surface the
request/limit commitment that usually only shows up as a FailedScheduling at
3 a.m.
OpenTelemetry-native
No proprietary agent to deploy or license. If your services already emit OTel traces into Splunk, the app reads them. Collector configuration is standard, and a generator produces the install commands for VM and Kubernetes rollouts.
AI root-cause analysis — on your LLM, not ours
Ask the app to explain an incident and it assembles the evidence — the golden signals for the window, the slowest and failing traces, the span waterfall, the bound SQL, the correlated error logs, the recent deployments and restarts, and the same window one week earlier — then has a language model reason over it and name a root cause, citing the trace ids, SQL and log lines it used.
Your data never leaves your control.
The analysis runs through your own LLM connection — either a model you reach from Splunk's AI Toolkit, or an external endpoint you host. We do not run a model, do not proxy the request, and never see your telemetry. There is no per-token charge from us, and no vendor model to trust with production traces.
This also means you must have a model available. See the FAQ before purchasing if you are not sure what you would connect it to — everything else in the product works without one.
What's included
One licence, every feature. There is no edition ladder and nothing held back for an upsell — if it is in the product, it is in your licence.
Application performance
- Overview — golden signals with day-over-day deltas and deployment markers, live active-transaction cylinder, DB call latency and slow-call counts, error log and recent-change feed
- Service Map — service topology with health, dependencies and per-node drill-down
- Trace Scatter (X-View) — response-time distribution across the window, click any point to open that trace
- Service Detail — per-endpoint RED metrics, Apdex, slow and error trace lists, error patterns, per-instance breakdown, JVM and Python runtime metrics
- Trace List & Trace View — searchable trace inventory, full span waterfall, bound SQL, correlated application logs, infrastructure metrics for the trace window
Kubernetes
- One-View — cluster → namespace → workload → pod hierarchy with a four-quadrant correlation of metrics, APM, logs and events
- Cluster & node detail — request/limit commitment, resource efficiency and idle waste, node conditions, pod density, persistent volume usage, control plane health, pod honeycomb
- Deployment timeline — every configuration version as an immutable record, with the rolled-back version and a version-to-version configuration diff
- Works on managed and self-managed clusters alike — EKS, AKS, GKE and on-premises
Infrastructure & agents
- Fleet Map — infrastructure honeycomb grouped by category and severity
- Server list & detail — inventory, liveness, load, storage, role processes
- Server classification — automatic role detection with an admin console for rules and overrides
- Agent Manager — collector fleet health from the collectors' own telemetry, inventory, per-node detail, and an install-command generator for VM and Kubernetes rollouts
- System Events — OS reboot, collector restart and crash timeline across the fleet, distinguished from one another rather than lumped together
Build your own
- Chart Studio — write SPL, get a themed chart with synchronised crosshairs and threshold colouring, save it, assemble dashboards by drag-and-drop, add filter bars and chart-to-chart deep links
- Publish to any app — a Studio dashboard can be published as a normal Splunk view in whichever app you choose, self-contained, with an edit deep link back
- Layout editor — rearrange the built-in dashboards themselves and save the layout for everyone
AI
- Incident analysis — evidence-backed root cause citing trace ids, SQL and log lines, using a model you connect
- Two integration modes — a single well-formed call through Splunk's AI Toolkit, or an external endpoint you host for multi-step investigation
- Asynchronous — analysis runs in the background; close the window and the result is waiting when you return
🚀 Actively developed — and updates are included
This product ships new capability continuously. Kubernetes deployment ledgers, node and capacity analysis, collector fleet management, the chart studio and AI root-cause analysis were all added after the first release, and the roadmap keeps going.
Every feature we release during your licence term is included at no extra cost — there is no upgrade fee, no new edition to move up to, and no feature that arrives locked. When we ship, you get it.
Building something for your environment that is not here yet? Tell us — a lot of what shipped this year started as a customer asking.
Licensing
Offline — no phone-home
Keys are RSA-signed and verified locally by the app. Nothing contacts a licence server, so air-gapped and network-restricted deployments work exactly like connected ones.
Locked to your Splunk deployment
A key is issued against your Deployment ID — your Splunk deployment's own identifier. It unlocks that deployment and no other.
DR and standby covered
A key can carry a second Deployment ID for your DR site. If you don't know it at checkout — most people don't — leave it blank and email us later. Adding it is free and does not shorten your term.
Unlimited scale
No per-host, per-service, per-GB or per-trace metering. Monitor 30 hosts or 3,000 for the same licence fee. Your Splunk indexing tier is the only thing that scales with volume, and that is a bill you already have.
| rest /services/server/info | eval deployment_id=coalesce(manager_guid, master_guid, guid) | table deployment_id
It returns a single value that looks like
ED2C6866-42DE-4179-8198-5FC1DE050707. That is what we need.
Not sure which instance to run it on? Ask us before you buy — a key
issued for the wrong deployment will not unlock anything.
Pricing
One flat price per Splunk deployment. Every feature included.
No per-host, per-service, per-GB or per-trace fees, and no edition ladder. The price does not change because you added services, hosts, clusters or traffic — and every feature released during your term is included.
Annual
- Every feature — nothing held back
- Unlimited hosts, services and search window
- All new features released during the term
- Node-locked to your deployment (plus a DR deployment, free)
- Email support
6 months
- Every feature — nothing held back
- Unlimited hosts, services and search window
- All new features released during the term
- Node-locked to your deployment (plus a DR deployment, free)
- Email support
Multiple deployments, a reseller or partner arrangement, a purchase order, or an evaluation licence before you commit? Get in touch — we would rather talk first than have you buy the wrong thing.
Payments are processed by Paddle.com, our merchant of record. Applicable taxes/VAT are handled at checkout.
FAQ
How do I get the app and my licence key after paying?
Both are emailed to you automatically, within a few minutes of your payment completing — the download link for the application package and your licence key, already locked to the Deployment ID you entered at checkout, with install steps. If it isn't in your inbox, check your spam/junk folder — it comes from support@innosw.net. You can always email us and we'll resend it.
Can I evaluate it before buying?
Yes — ask us for an evaluation licence and tell us a little about your environment. We would rather you prove it works on your own traces than take your money and find out afterwards that your data isn't shaped the way the product expects.
What data does the app need?
OpenTelemetry spans in a Splunk index. Point the apm_index macro at it and the
APM screens work. The Kubernetes screens additionally use the metrics, objects, events and
container logs that the standard Splunk OpenTelemetry Collector chart already sends. The
infrastructure and agent screens use host metrics and collector self-telemetry from the same
collector.
Do I need a special agent?
No. Standard OpenTelemetry instrumentation and the standard Splunk OTel Collector are enough. Two optional agent extensions add capabilities plain OTel does not have — bound SQL parameters and span-lifecycle events for live in-flight transactions — and both attach to the existing OpenTelemetry Java agent without touching your application code.
Where do I find my Deployment ID?
Run the search shown in the Licensing section above. It returns a single identifier. On a distributed deployment, run it on your license manager; on a standalone instance, run it there. If you are unsure, send us the output from both and we will tell you which one to use.
What if my Deployment ID changes?
Email us and we reissue the key at no cost, keeping your remaining term. This happens legitimately — DR failover, hardware replacement, a rebuilt search head — and we would rather reissue than have you blocked. For planned redundancy, ask us to put both deployments on the key up front.
Does the licence need internet access?
No. Verification is fully offline against a signature. Air-gapped environments are a first-class case, not an afterthought.
What do I need for the AI root-cause analysis?
A language model you can reach. Either configure a connection in Splunk's AI Toolkit and the app calls it with a single well-formed prompt, or point the app at an external LLM endpoint you host, in which case it can perform multi-step investigation. We do not supply a model. Everything else in the product works without one, so treat it as a capability you can switch on whenever a model becomes available to you.
How long does an analysis take?
It depends entirely on the model you connect. On a self-hosted 27 B reasoning model on a single GPU we measure roughly three to six minutes per analysis; hosted models are considerably faster. The app runs it in the background — you can close the window and the result is waiting when you come back.
Which Splunk versions are supported?
Splunk Enterprise 9.x with Python 3. Licence enforcement runs server-side as a Splunk custom search command, so it behaves correctly for non-admin roles as well.
Are new features extra?
No. Everything we release during your licence term is included — no upgrade fee, no new edition, no feature that arrives locked. The product is under active development and that is part of what the licence buys.
What happens when the licence expires?
The application stops providing its functionality until the licence is renewed. It does not delete anything, does not stop your Splunk deployment, and does not interfere with your environment in any other way — all the data it was reading is your own Splunk data and it stays exactly where it is.
Is my telemetry sent anywhere?
No. The app is a set of Splunk dashboards and search commands that run inside your own Splunk deployment. Nothing is transmitted to us — there is no phone-home, no usage reporting, and no proxy. The only outbound call the app can make is to the LLM endpoint you configure for root-cause analysis.