From Root Cause To Pull Request: AI SRE in Splunk Observability Cloud Can Now Remediate Incidents With Claude Managed Agents

The Gap Between Knowing and Fixing

Every on-call engineer knows the shape of a bad night. The pager goes off at 3 AM, the API is throwing 500s, and before you can do anything useful you're correlating metrics, logs, and traces across a dozen services while customer impact compounds.

The last three years of AI implementations in observability tooling made that night shorter, but not entirely different. Assistants would write your queries and summarize your incident. But the hand-off from "here's the probable root cause" to "here's the change that fixes it" was still mostly manual, still spread across tools, and still yours at 3 AM.

That's the gap we're closing. AI SRE in Splunk Observability Cloud—launched in generally availability this June—already integrates AI and agents across the incident lifecycle, with Observability Studio making instrumentation easier, AI-driven detection, alert grouping that collapses related application and infrastructure alerts into a single actionable incident, probable root cause with an evidence chain, and guided remediation plans. Today we're announcing work with Anthropic to add the final step—safely turning a verified diagnosis into a concrete code change and reviewable fix.

Splunk holds telemetry across the entire technology stack—network, infrastructure, application, and the AI models themselves. Frontier reasoning applied to that depth of operational context is a combination that no other observability vendor can offer today. And when an incident hits, the outcome for engineering teams now looks different: a proposed fix and a detection for next time, not a root cause analysis alone.

What’s New: A Remediation Agent in Splunk Observability Studio, Built on Claude Managed Agents

AI SRE in Observability Cloud acts as an agentic teammate to help reduce complexity and toil. Intelligent alerting groups and consolidates alerts into unified, actionable incidents. The AI troubleshooting agent analyzes all telemetry data to pinpoint where a complex issue potentially started. Teams can then execute guided remediation plans or use a remediation agent powered by Claude Managed Agents to execute code-level fixes in secure sandboxes, keeping engineers in full control and building trust.

Splunk brings the intelligence and the guardrails as the source of truth for what is happening in the system. AI SRE and Observability Studio are new capabilities for Splunk Observability Cloud that turn a storm of signals into a single, evidence-backed hypothesis. And Observability Studio is the control plane — it owns the workflow, decides what is allowed to change, runs validation, opens the merge request, and confirms the fix worked. Splunk also holds the credentials, the policy, and the final record of truth.

Anthropic brings the runtime. Claude Managed Agents provides a managed environment for running a coding agent safely: a disposable, network-isolated sandbox where Claude reasons over real source code and produces a candidate change. It is deliberately scoped as an execution engine—it receives a well-formed task, does focused work, and hands back a result.

Most agent cost and unreliability comes from agents retrying and repeating investigations. Using Claude Managed Agents' performance-optimized harness keeps a long-running investigation from looping and spiking costs.

How It Works, End To End

Telemetry should be in place before an incident. Observability Studio—now generally available— brings OpenTelemetry instrumentation directly into the IDE, eliminating the need for developers to manully add instrumentation. Ask Observability Studio to audit the codebase, and it can recommend the telemetry a service should emit, resolve dependencies, apply the instrumentation, and verify spans and metrics while the service is running locally. Instrumentation becomes a guided, automated workflow rather than a manual chore — Observability Studio adds the OpenTelemetry SDK, wires up traces, metrics, and logs, and confirms the signals are flowing before you move on. And if you already know which metrics matter, you can tune the telemetry to align it to your business. Addressing observability only after deployment creates a costly, reactive retrofit and risks losing critical context.

Detection happens without having to hand-tune all your thresholds. AI detection watches the application and Kubernetes environment. Teams don't need to start by defining every detector from scratch.

Related alerts become one incident. AI-detected and custom signals across application and infrastructure are grouped, with the reason for grouping shown. This is what gives the troubleshooting agent the context it needs to investigate — and what keeps the engineer out of constant and repetitive alert triage.

The troubleshooting agent in Observability Cloud then investigates. With the incident and page context, it stitches together metrics, events, logs, and traces, investigates and returns the most likely root cause with a confidence level and the evidence chain behind it. In our keynote demo at .conf26, a retail storefront under promotional traffic hits a concurrency issue that only surfaces under load—the kind of finding that requires reading the telemetry, not the code alone.

The remediation agent, powered by Claude Managed Agents, proposes the fix. Because the remediation agent starts from the root cause the investigation is already established, it goes straight to the relevant code with the telemetry in hand. It produces a staged plan with a validation step, and a pull request. You can run it from Splunk Observability Cloud or Observability Studio in your IDE when the underlying issue is in the code.

As you continue to use the agent for code level remediation, it gets better and better. Whatever you do with the PR—merge, edit, or close—is feedback. Because Claude Managed Agents provides session management and memory stores, that feedback persists, and the agent consolidates what it learned between incidents. Every incident an engineer works alongside it leaves the runbook better than it found it.

The engineer still reviews a PR, they're just not debugging at 3 AM.

Availability

AI SRE in Splunk Observability Cloud: Generally Available

Observability Studio: Generally Available

Remediation powered by Claude Managed Agents: In Alpha