January 2026

Release notes for January 2026

Splunk Observability Cloud released the following new features and enhancements in January 2026. This is not an exhaustive list of changes in the Splunk Observability Cloud ecosystem. For a detailed breakdown of changes in versioned components, see the list of changelogs.

New feature or enhancementDescriptionRelease date
Application Performance Monitoring

Create a Monitoring MetricSet (MMS) with up to 5 custom dimensions to filter your data for more detailed monitoring and analysis.

To learn more about multi-dimension MMS and how to use them, see About custom Monitoring MetricSets.

To learn how to create a multi-dimension MMS, see Create a Monitoring MetricSet with custom dimensions.

January 22, 2026
Archive and restore histogram metrics

You can archive and restore histogram metrics through Metric Pipeline Management (MPM), allowing histogram metrics to be stored in real-time and archived data stores. Previously, archiving histogram metrics was not supported. See Introduction to metrics pipeline management.

With this enhancement, you can:
  • Archive histogram metrics in the archived data store at a tenth of the cost of real-time metrics.
  • Restore on-demand archived histogram metrics from the archived tier.
  • Optimize metrics usage and manage observability costs more efficiently while retaining access to historical histogram data.
January 22, 2026
New Kubernetes experience

Monitor your Kubernetes infrastructure with a new experience that includes the following features:

  • Monitor Horizontal Pod Autoscaler (HPA) instances with the HPA entity type. To switch between entity types, see Refine your view with the left navigation panel.

  • View additional Kubernetes properties in the table and detail view for the following entities:

    • Clusters: API server version, which is retrieved from the kubernetes_build_info control plane metric via Prometheus.

    • Clusters: Kubelet version. This is a node-level property. If there are multiple Kubelet versions within a cluster, all relevant versions are listed.

    • Nodes: Kubelet version.

    • Containers: Container image name and version.

  • A newly designed detail view, which now also opens in a flyout panel for in-context navigation instead of a new page.

  • View all node conditions, including pressure conditions.

The new Kubernetes experience includes the following changes to existing Kubernetes monitoring features:

  • The Overview tab was renamed to the Dashboard tab.

Feature availability depends on your Splunk Distribution of the OpenTelemetry Collector version. Use version 0.138.1 or higher for access to all features. For instructions, see Collector for Kubernetes のアップグレード.

To use the new Kubernetes experience, you must opt in on the user interface. For instructions, see Access the Kubernetes entities page.

The classic Kubernetes navigator experience will be deprecated by February 2026.

January 22, 2026
Splunk Distribution of the OpenTelemetry Collector

Version 0.138.1 includes the following changes related to the new Kubernetes experience:

  • For HPA, the target workload property is enabled by default.

  • For clusters, the API server version property is enabled by default. The kubernetes_build_info control plane metric is now enabled by default to report API server versions.

  • For nodes, the kubelet version property is enabled by default. The new k8s.node.condition metric is enabled by default to report node pressure states.

  • For pods, the Quality of Service (QoS) class property is enabled by default. The k8s.pod.status_reason metric is enabled by default to report pod statuses.

  • For containers, the new k8s.container.status.reason metric is enabled by default to report container status at the pod level.

  • A new configuration is enabled by default to support collecting and displaying pod instance YAML files in the new Kubernetes experience. This configuration enables pod information to be collected and sent to the Splunk Enterprise and Splunk Cloud Platform log endpoint every 6 hours.

For more information on these metrics, see _________ _______ ___ __________ ___ __________.

For upgrade instructions, see Collector for Kubernetes のアップグレード.

January 22, 2026
Cisco ThousandEyes and RUM integrationIntegrate ThousandEyes with Splunk RUM to bring together your application and internet network data in one place. Correlate real user performance from RUM with underlying network conditions to quickly identify the source of application alerts. To learn more, see [Alpha] Splunk RUM と ThousandEyes の統合.January 22, 2026
View URL page groups in RUMView all your URL groups and key metrics, such as page load time and errors, for your mobile or browser applications in RUM. Additionally, drill down on key metrics in Tag Spotlight for additional troubleshooting. To learn more, see Manage URL grouping rules.January 22, 2026
Manage RUM licenses using token poolsCentrally assign and manage RUM session licenses across multiple teams, apps, or business units by allocating tokens. To learn more, see Manage your RUM access token​.January 22, 2026
Database Monitoring
  • Monitor your PostgreSQL database platforms and correlate the queries they run with the Java applications that those queries come from. To learn more, see Collect data from PostgreSQL.

  • View the dependencies and metadata associated with each of your monitored database platforms.

January 22, 2026
Secure Application Secure Application, a new add-on for Splunk APM,

provides detailed application security run-time detection without the need to deploy extra agents through the following key features:

  • Run-time vulnerabilities detection with application and risk context.

  • Run-time visibility of application libraries with application context.

  • Notifications about new vulnerabilities associated with specific environments and services. These notifications can be ingested into Splunk Cloud and Splunk Platform.

To learn more, see Introduction to Splunk Secure Application.

January 22, 2026
Encrypt SAML assertionsWith SAML encryption assertion, you can prevent unauthorized parties from reading the content of a SAML message. Splunk Observability Cloud now offers this additional layer of security. See the following for more information:January 22, 2026
Admin API token

Assign an org token to the Admin role to ensure streamlined access control and enhanced security for organizational operations. See the following:

January 22, 2026
Persistent and context-aware logs experience in the service viewThe Splunk APM service-centric view now has a persistent, accurate, and context-aware logs experience that unifies environment selection, eliminates legacy configuration paths, and aligns all log resolution through a single, authoritative entity–index mapping system. See Use the service view in Splunk APM.January 22, 2026
Optimized logs searches in dashboardsLogs searches that run in dashboards are now more efficient since the system searches only logs in indexes that the user can access rather than all indexes. See Built-in dashboards. January 22, 2026
Entity-index mapping for usersSplunk Observability Cloud now automatically triggers entity-index mapping generation so that a user's logs experience only takes into account the indexes that a user has access to. Automatic entity-index generation occurs on demand when users access logs experiences in Related Content, the APM service-centric view, or prepackaged observability dashboards. See Entity-index mappings.January 22, 2026