Splunk Observability Studio

Give your coding agent an evidence-backed OpenTelemetry workflow, then inspect the proof without leaving your editor. The extension bundles agent skills and a local Splunk Observability Studio runtime for traces, metrics, logs, services, validation, dashboard previews, and optional Splunk Observability Cloud export.

Install

After installing:

1. Run Splunk Observability Studio: Open.
2. For Cursor, Kiro, Claude Code, or Codex, accept the detected integration prompt or run the matching enable command from the Command Palette.
3. After enabling an integration, fully restart the agent and start a new task so it reloads its skills and local MCP connection.

The extension provides these integration commands:

For Copilot, Windsurf, and Devin Desktop setup, follow the standalone CLI instructions in the user guide.

Run your first audit

From the service root, enter the audit command in your coding-agent chat:

Open the returned report and follow the next step it recommends. The user guide explains the complete audit, instrumentation, verification, and publishing workflow.

Inspect the proof

Run Splunk Observability Studio: Open to inspect the evidence inside your editor. See the Splunk Observability Studio guide for runtime behavior, endpoints, views, and API details.

Trace a request. Open a trace to inspect its waterfall and slow dependencies.

Preview a dashboard. Generate a dashboard with your agent, then compare the layout with local telemetry. The preview is approximate because SignalFlow runs in Splunk Observability Cloud.

Inspect metrics and logs. Filter retained metric series and structured logs without leaving the editor.

Validate semantic conventions. Run the bundled OpenTelemetry Weaver validator and inspect actionable findings by signal and severity.

Commands and configuration

Extension settings use the observability-studio. prefix:

• managedObserverPort moves the extension-managed UI, REST API, and MCP endpoint. Its OTLP receivers remain fixed at 4318 and 4317.
• sharedObserverUrl reuses another Splunk Observability Studio instance running on this machine. Use localhost or 127.0.0.1 in the URL. It must report the same version bundled with the extension; send telemetry to that instance's own receiver endpoints.

Data and permissions

An extension-managed Splunk Observability Studio instance keeps received telemetry local unless you enable Cloud export. A separately managed local instance follows its own configuration. Cloud export sends traces and metrics, not logs, and the extension stores its access token in IDE secret storage.

For the bundled Codex and Claude Code plugin, see its security and privacy contracts.

Troubleshooting

• If Splunk Observability Studio cannot start, check the selected UI/MCP port and the fixed OTLP ports 4318 and 4317. Changing managedObserverPort does not move the OTLP receivers; stop the conflicting process or reuse another local instance.
• If sharedObserverUrl does not connect, confirm that the configured local Splunk Observability Studio is reachable and its version matches the extension.
• After enabling an integration, fully restart the agent and start a new task. Existing processes keep their startup settings.
• Dashboard previews use the first workspace folder captured when Splunk Observability Studio starts. Open the service in its own window or make it the first folder, then run Splunk Observability Studio: Restart after switching repositories.
• Use Splunk Observability Studio: Status to restart, reconnect, or open extension logs.

Resources

No separate collector, web runtime, or Weaver installation is required for normal extension use.

• User guide
• Splunk Observability Studio guide
• Example prompts
• Source and releases
• Contributing