Splunk Outage History

Some customers are experiencing ingestion issues due to a DNS synchronization issue affecting HEC dash DNS records using the format http-inputs-${stack}.splunkcloud.com. HEC ingestion using the current dot-format DNS records, http-inputs.${stack}.splunkcloud.com, is functioning correctly. As a mitigation, customers using the dash-format HEC endpoint should update their upstream systems to use the dot-format endpoint: http-inputs.${stack}.splunkcloud.com. Our engineering teams are working to restore the affected DNS records through Zone DNS synchronization. We will provide another update once DNS synchronization has completed or if there is a meaningful change in impact.

We’re investigating an issue affecting some customers hosted in ap-northeast-1, eu-central-1, and us-east-1. Impacted Splunk Cloud Platform customers in these regions may experience access issues. Our teams are actively working to restore service, and we’ll share updates as more information becomes available

We identified an issue caused by an internal change on May 26, 2026, that impacted ingestion through a PrivateLink. A fix has been identified, released and is currently rolling out. Some customers may continue to experience impact while the fix is being applied. We’ll provide another update once rollout is complete. Our teams are actively working to restore service and will provide another update as soon as more information is available

We are currently addressing a major service disruption affecting search performance, which began at 16:34 UTC. Users may experience degraded search performance and intermittent UI errors. Our engineering teams have identified the root cause and are actively working to deploy a resolution. We are monitoring the situation closely and will provide further updates as they become available.

We are observing service recovery for the majority of our customers. Our engineering teams are actively investigating and addressing the remaining isolated cases where service has not yet been fully restored. We will continue to monitor the environment closely until all services are operating at normal capacity.

Our engineering teams have narrowed the scope of the issue: Any search utilizing the KV Services were failing. This impact extended to the Mission Control and Analyst Queue dashboards. Additionally, we have identified the root cause and are actively mitigating the impact. Once mitigation is complete, we will continue to monitor the environment to ensure service stability for all users. We will continue to provide status updates as more information becomes available. We apologize for the inconvenience and appreciate your patience.

Cisco is aware of an ongoing cloud service provider outage in the Middle East affecting multiple cloud offers and services. As a result, Login, Search and Ingest may be impacted for customers in the affected region. Cisco and Splunk are exploring what options are available for affected customers and will contact those affected customers directly. We will continue to closely monitor this issue as it unfolds.

Cisco is aware of an ongoing cloud service provider outage in the Middle East affecting multiple cloud offers and services. As a result, Login, Search and Ingest may be impacted for customers in the affected region. Cisco and Splunk are exploring what options are available for affected customers and will contact those affected customers directly. We will continue to closely monitor this issue as it unfolds.

Cisco is aware of an ongoing cloud service provider outage in the Middle East affecting multiple cloud offers and services. As a result, Login, Search and Ingest may be impacted for customers in the affected region. Cisco and Splunk are exploring what options are available for affected customers and will contact those affected customers directly. We will continue to closely monitor this issue as it unfolds.

The issue has been identified and a fix is being implemented.

The issue has been identified and a temporary fix is implemented.

The issue has been identified and a fix is being implemented. Please note that the issue ONLY affects the Splunk mobile app, and not customer's Splunk Enterprise/Splunk Cloud instances.

A fix has been identified and is being currently implemented. Please note that the issue ONLY affects the Splunk mobile app, and not customer's Splunk Enterprise/Splunk Cloud instances.

We are investigating a reported issue for all stacks hosted on GCP. As a result, the Splunk Cloud Platform environment may be inaccessible for customers. Please refer to the current live updates from GCP here - https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW Our teams are monitoring the status of the outage. Your patience is greatly appreciated and we will provide more updates upon resolution.

We are continuing to work on a fix for this issue.

Splunk is aware of an issue currently affecting SOAR customers. As a result of the issue, users will not be able to save playbooks after making edits. Error message: "Unexpected keyword argument 'code_names' in function call" We understand the impact this has on your operations and are working to resolve the issue as quickly as possible. We will provide more information when it becomes available. No actions are needed from customers at this time. Thank you for your patience and understanding.

Hello, Splunk Cloud customers using the SOAR platform may be impacted by Playbooks appearing to load but backend logic failing. We have identified the source of the issue in version 6.4.1 and are currently working on implementing a fix. At this time, there is no further action needed from customers. There is an active workaround to mitigate impact: - Open the playbook in the Visual Playbook Editor (VPE). - Manually review and adjust the join settings (check/uncheck as needed). - Save the playbook to apply the changes Your patience is greatly appreciated and we will provide more updates as we implement the fix.

Splunk has identified an issue in SOAR version 6.4.1 where Playbooks may appear to load correctly but failing in backend execution. A fix is in progress, and no immediate action is required from customers. As a workaround, to mitigate the impact: - Open the playbook in the Visual Playbook Editor (VPE) - Manually review and adjust the join settings (check/uncheck as needed) - Save the playbook to apply the changes We appreciate your patience and will share further updates as the fix is implemented.

503 errors being returned for ACS calls to list maintenance schedules for several customers. Error message "multiple concurrent requests can cause the service to become unavailable. Retry your request at a later time" were observed on CMC Maintenance Windows dashboard. We have identified the source of the issue and are currently working on implementing a fix.