Case Study: Splunk reduces security infrastructure costs and unifies observability with CNCF’s Tetragon

Splunk cuts CPU utilization by 67% with Cloud Native Computing Foundation

Splunk, a data analytics and observability platform, faced significant security and operational challenges due to fragmented tools securing its vast cloud environment. Operating approximately 170,000 cloud resources, its security team struggled with inconsistent coverage and heavy maintenance from running multiple, non-Kubernetes-aware services. This fragmentation created security gaps and required policies to be implemented separately for virtual machines and Kubernetes clusters, which was unsustainable at their scale.

The Cloud Native Computing Foundation’s open source Tetragon project provided the solution. By deploying Tetragon, Splunk replaced three legacy tools with a single, eBPF-based solution that delivers deep runtime security observability. This eliminated the need for complex daemonsets and sidecars, dramatically reducing infrastructure overhead. The Cloud Native Computing Foundation’s technology enabled Splunk to achieve a 67% reduction in CPU utilization and a 74% reduction in memory utilization while improving security data quality and extending a consistent security layer across its entire environment.

Splunk