Release history for the Splunk Network Intelligence Application

Release history for the Splunk Network Intelligence Application.

Version 26.10.0

Version 26.10.0 of Splunk Network Intelligence Application is the latest version and it was released on October 30, 2026.

Table 1. Release highlights
New feature or enhancement Description
SNMP support for graph materialization

Splunk Connect for SNMP (SC4SNMP) can provide device and interface inventory plus LLDP neighbor data for Network Intelligence graph materialization and physical topology. The documented example polling profile is topology-only; the release payload also lists health and telemetry polling, pending confirmation of the final release scope. See No Content found for /db/organizations/splunk/repositories/portal-production/content/documents/Splunk_Supported_AddOns/network-intelligence/configure_splunk_network_intelligence.dita.
UI improvements for Configuration and Device/Site Topology

Configuration provides per-source indexed-data selection, sourcetype coverage and analysis, per-search scheduling, tracked and cancellable backfill, and application log-level controls; source changes trigger associated searches.

Home, Sites, Devices, and Device Details add health summaries and history, sorting, search and pagination, interface and related-entity details, and updated physical L1/L2 topology controls with hop scope, node and connection details, traffic labels, and peer navigation.

Alerts add normalized Cisco Catalyst Center and Cisco ThousandEyes records with filters, sorting, pagination, and a collapsible summary rail.

See No Content found for /db/organizations/splunk/repositories/portal-production/content/documents/Splunk_Supported_AddOns/network-intelligence/network_intelligence_application.dita.

Network Intelligence displays the devices, metrics, alerts, and topology returned by configured and supported sources. Available fields depend on source coverage and the selected time range. Missing or stale data is not the same as measured zero, and a neutral topology indicator does not by itself establish that a connection is healthy. See the configuration documentation for source coverage and setup context.

Version 26.9.0

Version 26.9.0 of Splunk Network Intelligence Application was released on September 30, 2026.

New features

This version has the following new features:

Jira New feature or enhancement Description
NI-165 Home page network summaries The Home page now uses production APIs for network summaries, site health, and devices needing attention.
NI-148 Site health view Operators can review site health metrics in a searchable, filterable, sortable, and paginated view.
NI-205, NI-206 Site details, topology, and inventory Operators can open a site-specific details page with its Layer 2 topology and device inventory. The topology API supports queries scoped to a site, including connected cross-site dependencies.
NI-126 Unified device inventory The Devices view brings device status, connectivity, alerts, source, and site into one inventory, with navigation to device details.
NI-133 Server-side device inventory controls Operators can filter, sort, and paginate device results using server-side queries.
NI-132 Device MAC addresses The Devices inventory displays a device’s MAC address when one is available.
NI-164 Shared site and time filters Network Intelligence pages now provide shared site and time filters for working with data across views.
NI-187 Pagination controls above and below tables Operators can access pagination controls at both the top and bottom of paginated tables.
NI-198 Device details navigation and layout Device details opens to Health and alerts by default, with KPIs above alerts. Operators can switch interface views and collapse the topology panel.
NI-185 Dynamic device details The Details panel displays available device properties returned by the API, including newly returned fields, without requiring a separate UI mapping for each field.
NI-200 Capability-based health cards Device health cards show each capability’s state, the metrics that inform it, and when it was last observed.
NI-181 Device interface inventory The Interfaces panel uses backend data to show a device’s interfaces, health and status, and connection context.
NI-207 Topology exploration controls Operators can open device details from topology nodes and choose an exploration depth of one, two, or three hops. The default depth is two hops.
NI-74 Alerts dashboard The Alerts dashboard presents alert totals and severity breakdowns, with filters and navigation to alert results.
NI-208 Site alert counts and filtered drilldowns Home page site cards show alert counts and link to matching alert results. Alert filters persist through refresh and browser navigation.
NI-19 Read-only alerts API The vendor-neutral alerts API supports time, severity, status, site, and graph-subject filters, along with snapshot-based pagination.
NI-83 Alert-to-device graph resolution Network Intelligence resolves source alert identifiers to graph entities, preserves multiple matches, and identifies missing or unmatched identifiers.
NI-209 Consistent site and device drilldowns Site and device links provide consistent navigation from Home, Site Health, Alerts, and other supported views.
NI-48 ThousandEyes inventory from metric data Network Intelligence derives ThousandEyes agent and test inventory from metric data, removing the need for redundant custom agent and test inputs. The synthetic-vantage entity type is retired.
NI-191 Catalyst Center health metrics Network Intelligence adds Catalyst Center health coverage for device availability, CPU and memory telemetry, interface status, and interface throughput where data is available.
NI-176 Data-source settings Administrators can configure indexes, collection intervals, and enablement for each supported data source, with shared defaults and per-source overrides.
NI-177 Data-source configuration page Administrators can configure Meraki, Catalyst Center, and ThousandEyes through a capability-gated UI.
NI-180 Role-based access to pages Access to Network Intelligence pages is controlled by Splunk role and page permissions.
NI-93 Network Intelligence capabilities and roles Network Intelligence defines capabilities for read and administrative operations and provides default role assignments.
NI-97 Capability checks for API routes API routes check whether a user has the capability required for an operation. This change does not add site-scoped or data-level visibility filtering.
NI-183 Dedicated application log sourcetype Network Intelligence application logs use a dedicated sourcetype, making them easier to find and search in Splunk.