Cisco announces Splunk & Snowflake integration for unified data

Cisco has announced Splunk Federated Search for Snowflake, an integration designed to connect and query operational and business data across Splunk and Snowflake platforms.

The new capability is intended to tackle the growing challenges faced by organisations in the agentic artificial intelligence era, where data volumes and sources are expanding rapidly and critical information is often distributed across multiple, sometimes disconnected, environments. Unified data visibility has become increasingly necessary to meet security, observability and operational requirements in these conditions.

Splunk Federated Search for Snowflake will enable teams to query data stored within Snowflake's platform directly from the Splunk interface. Users can then join Snowflake data with data already indexed by Splunk to enhance analytical capability and generate broader business and operational insights.

According to Cisco, this integration is an example of its priorities around promoting open data ecosystems. By connecting Snowflake with Splunk, Cisco aims to help organisations accelerate business insights while keeping the strengths of both platforms intact.

Splunk Federated Search for Snowflake makes it simple for customers to access and act on their data, uniting business and operational insights in one view," said Kamal Hathi, SVP and GM, Splunk, a Cisco company. "Together with the Snowflake integration, we're creating a more open ecosystem to help organizations use data to make faster decisions, accelerate innovation, and deliver more trusted customer experiences.

The integration seeks to simplify how teams manage diverse data for critical use cases in IT operations, security operations, and engineering. It provides a way to move beyond data silos, fostering faster issue detection and resolution by correlating business and operational information.

Our integration with Splunk extends Snowflake as a trusted platform for unifying and simplifying data access at scale," said Carl Perry, Head of Analytics, Snowflake. "Through the integration, Snowflake and Splunk will be able to more effectively connect data and break down silos for our joint customers. This makes it easier for organizations to harness business and operational data, enabling insights to flow to where they are needed most to power data insights and AI innovation at scale. This integration will give enterprises the power to drive faster data-driven decisions and will help them stay ahead in the AI era where data is paramount.

Splunk Federated Search for Snowflake offers several specific features. These include the ability to add Snowflake as a data source within Splunk, allowing straightforward onboarding. Users will be able to write SPL-like queries in the Splunk interface to access and search Snowflake-stored data. Additionally, the integration utilises the latest Splunk Federation capabilities to perform data joins between datasets stored in both Snowflake and Splunk, intended to provide richer business context and deeper analytical insight.

There is also a focus on efficient data processing. Leveraging Snowflake's analytics, the system can execute partial queries within Snowflake before merging and finalising the results in Splunk, an approach that aims to optimise resource use and enable more comprehensive analysis.

An upcoming demonstration of the integration will illustrate how Splunk Federated Search for Snowflake brings together operational and business data, leveraging platforms such as Amazon Web Services S3 and Snowflake as federated data sources. This live showcase aims to provide organisations with practical insight into how they can break down data silos and improve decision-making processes, maintaining the independent strengths of both Splunk and Snowflake.

Splunk Federated Search for Snowflake will become available globally for Splunk Cloud AWS commercial customers in July 2026. Availability details for other regions and platforms may be subject to change.