Cisco Splunk’s State of Observability 2026 report found that 38% of organizations have cut telemetry coverage or retention to rein in spending. For network teams, those cuts can remove evidence needed to investigate past incidents or intermittent faults. AI agents add another collection challenge, but the practical decision remains which data operators need to keep.
Start With the Evidence Troubleshooting Requires
Greg Leffler, director of developer evangelism at Splunk, said cost-driven reductions often sacrifice historical investigations and unusual troubleshooting cases. Shorter retention leaves less history to examine. Lower sampling raises the chance that an intermittent network fault goes unrecorded.
Which records would your team need to investigate a fault that has already disappeared?
That question should guide collection changes before teams reduce coverage across the board. The survey, which gathered responses from 2,050 IT operations and engineering professionals in 10 countries, shows substantial pressure to make those changes. Cisco Splunk found that observability spending surpassed the expense of the monitored infrastructure for 57% of organizations. Unexpected bill increases caused greater operational strain than persistently high spending for 60%.
Predictability counts. A collection policy needs to preserve useful evidence while giving operators a clearer basis for controlling costs.
Separate Agent Telemetry From Existing Collection Waste
The report doesn’t establish how much of the spending increase comes from AI agents. Leffler acknowledged that the research did not measure their contribution separately from traditional collection practices.
Respondents’ largest observability cost drivers provide a useful starting point:
- Noisy logs: 31%.
- Metrics with high cardinality: 27%.
- Trace volume: 21%.
- AI infrastructure: 6%.
Review those existing sources before treating every expensive telemetry stream as an agent problem.
Agents still change what teams must observe. Kamal Hathi, senior vice president and general manager of Splunk at Cisco, said production agents emit 4-5x more telemetry data. Their records extend beyond application traces to tool calls, retrieved context, authentication, and interactions with models. Hathi said interactions among multiple agents can cause telemetry volume to grow exponentially.
Leffler described agents as both producers and users of machine data, creating a dual demand that can make expenses unpredictable. Cisco Splunk also found that 55% of respondents couldn’t accurately control AI spending.
The configuration question is specific: which agent records support an investigation, and which merely increase collection volume? The findings support reviewing that distinction, not assuming all agent telemetry has equal operational value.
Define Ownership Before Adding More Monitoring
Collecting more data won’t resolve unclear monitoring responsibilities. Although 87% of respondents prioritized AI monitoring, Cisco Splunk found that 38% lacked clear ownership. Another 49% reported inadequate AI monitoring capabilities in their observability tools, while 56% couldn’t measure workload metrics such as response quality.
Hathi said evaluating output requires teams to agree on quality for each use case and develop the skills to assess it accurately.
For network operators, the remit remains concrete. Leffler said teams need to track latency and packet loss and work with security colleagues to distinguish legitimate agent traffic from malicious activity. Repeated API calls by an agent, for example, can resemble attack traffic. The report found that AI workload monitoring had increased cooperation between observability and security teams for 81% of respondents.
Use Collection Controls Without Erasing Useful History
Leffler recommends the vendor-neutral OpenTelemetry Collector to process and export telemetry. He said its processors can help manage costs and tag traffic sources, improving visibility into agents and their supporting infrastructure.
That gives teams a practical option to evaluate, rather than a reason to collect everything. Review noisy sources, decide what history investigations require, and assign responsibility for agent monitoring before changing retention or sampling. Any proposed reduction should be checked against the faults the network team still needs to diagnose.
