Grafana Labs dominated the period with the largest single release event in this collection so far: ObservabilityCON 2026 on October 20 brought always-on monitoring agents, a sandbox where its assistant can prepare code fixes, a wider Knowledge Graph and a paid plugin marketplace. Splunk had a mixed fortnight: Singapore's Cyber Security Agency relayed fixes for a 9.8-rated flaw in Splunk Enterprise a few days before Splunk published its annual State of Observability survey. Coralogix published live performance benchmarks, and Observe and Dynatrace produced smaller items.

Grafana Labs at ObservabilityCON 2026

The AI announcements center on Grafana Assistant. Assistant Watchers, now generally available, are always-on agents that learn the normal patterns in a team's telemetry and flag changes that no predefined alert rule covers, attaching supporting evidence, routing findings through Grafana Alerting and opening an Investigation when a finding is critical. Agent Observability with OpenTelemetry support, also generally available, makes agent activity and cost visible in the same standard as other services. Grafana Managed Sandboxes, in public preview, give the Assistant a controlled cloud environment where it can clone a repository, investigate code against live telemetry, prepare a fix and open a pull request for human review. Grafana Pages, also in public preview, is a way to build app-like visualizations outside fixed dashboards.

The full-stack announcements extend the Knowledge Graph, which Grafana now includes in every Grafana Cloud stack, from databases and Kubernetes out to the user's browser and phone through frontend and synthetic monitoring. Custom entities that group resources into business-level items such as a product are generally available, as is runtime context for agents, including a new Cypher query capability. A service catalog with owners, on-call schedules and runbooks is in private preview. On the digital experience side, Session Replay entered public preview, while Mobile Observability for iOS, Android, React Native and Flutter and Critical User Journeys are in private preview. Incident response gained Grafana Workflows for event-driven automation (public preview) and a Response Console where people and agents work an incident from the same Knowledge Graph context (private preview).

Grafana also made the Grafana Marketplace generally available after an April pilot. It lists more than 30 partner-backed plugins, partners earn revenue from paid plugins while Grafana Labs handles billing and payment, support comes from the partner that built each plugin, and Grafana Cloud users can trial any Marketplace plugin for 14 days. With Agent Observability, Grafana joins the agent monitoring releases covered in Update #9: Honeycomb's AI Ecosystem on September 29, Dynatrace's completed Arize acquisition on October 1 and New Relic's AI Evaluation on October 6.

Splunk: A Critical Fix and an Annual Survey

On October 16, Singapore's Cyber Security Agency issued an alert on critical vulnerabilities in Splunk Enterprise, relaying two Splunk advisories released on October 7. The most severe, CVE-2026-76268 (CVSS 9.8), lets an unauthenticated attacker with network access to the Patroni REST API run operating system commands on Splunk Enterprise 10.4 and 10.2 deployments. A companion hardening advisory covers further internally found issues across all supported branches, rated up to 9.8. Fixed versions are 10.4.3, 10.2.7, 10.0.10 and 9.4.15. For CVE-2026-76268, Splunk documents a workaround for deployments that do not use Edge Processor, OpAmp or SPL2 data pipelines: set disabled = true in the [postgres] stanza of server.conf and restart. Neither Splunk nor the CSA alert reports exploitation in the wild, and the versions recommended in June for CVE-2026-20253 are among those affected.

On October 20, Splunk published its State of Observability 2026 report, based on a survey of 2,050 ITOps and engineering respondents in 10 countries, fielded by Oxford Economics in February and March. 87% confirm that monitoring AI is a priority for their organization, and of those, 54% do not have clear business outcomes tied to it. 57% say their telemetry costs have exceeded the cost of the infrastructure being monitored. The survey predates most of the agent observability launches of the past month, and it comes from a vendor that sells into the gap it describes.

Coralogix Publishes Live Benchmarks

On October 14, Coralogix launched Telemetry Lake Benchmarks, a public site reporting query volumes, ingestion and response times from production workloads on telemetry stored in customers' own cloud object storage, refreshed every five minutes and downloadable for checking. At launch it showed more than 4 billion queries and about 50 petabytes ingested over seven days, and in one account ingesting about 40 TB a day, half of all queries, including joins and window functions, returned in about one second. Coralogix also reported a test of AI agents investigating incidents on five unnamed observability platforms with the same demo application and a $10,000 monthly budget each, in which it led in nine of ten scenarios. All figures are self-reported and come from a paid press release. This is the first Coralogix item in the weekly collection since August.

Observe and Dynatrace

Observe's agent observability launch event at Snowflake World Tour in New York, noted in Update #8, went ahead. An analyst write-up from October 22 describes a context graph that maps relationships across incoming logs and metrics so AI agents can query structured data with fewer tokens, and Observe Agent Observability correlating the tools agents call with backend telemetry. It gives no availability dates or pricing, and it is the only source in the collection.

Dynatrace named Carahsoft its 2026 Public Sector Distributor of the Year on October 15, citing its work growing the reseller and systems integrator ecosystem; Carahsoft has distributed Dynatrace in the public sector since 2023. On October 20 the company scheduled its fiscal Q2 2027 results for November 3, the first report covering the quarter in which the Arize acquisition closed.

Background: Two Releases From the Previous Period

Two announcements from the period of Update #9 were missing from that week's collection and are listed here for completeness. On September 30, Splunk announced Splunk Cloud Platform 10.6 and Splunk Enterprise 10.6, with the Splunk AI Assistant and MCP server installed by default in eligible cloud environments and Cisco AI Canvas generally available for US customers using Cisco Cloud Control. On October 1, Palo Alto Networks introduced Cortex XCOR, the observability platform built from Chronosphere, whose AI SRE the company says reaches a root cause in under three minutes on average, with a 75% success rate in complex production environments by its own measure.

What to Watch

Dynatrace reports on November 3, and New Relic's AI Evaluation enters public preview in November. Several of Grafana's ObservabilityCON items are in public or private preview, so general availability dates are the next milestones. Splunk Enterprise administrators on 10.4 or 10.2 have a 9.8-rated, unauthenticated issue to patch or mitigate.