Skip to main content
SparkLogs Foundry · Cohort intake open

Bring agentic IT diagnostics to your service desk.

An invitation-only program for MSPs. Your engineers close hard tickets in minutes, not hours.

Learn More Try the live demo
0:00 / 0:00

All videos
  • 49curated data sources
  • 1 yearof history on every device
  • Secondsto query billions of events
  • Any AIClaude, Copilot, Codex, IronRunBook, MCP
Fleet-wide IT Intelligence

Hunt issues proactively. Uncover the blast radius.

Northridge50 endpointsLakeview112 endpointsHarborview62 endpointsWestgate92 endpoints
316 endpoints · 4 clients · 57 serversPick a question to sweep the fleet
Sources drawn on:Storage IOWindows servicingSystem logSystem identity
Connected to SparkLogs
Claude · Copilot · Codex · MCP
Answers name the sources they drew on.Connect your AI
Root-cause Analysis

Simultaneously analyze every signal relevant to a tough ticket. Fix it faster.

See all data feeds
It crashed or hungCrashes and hangsDisk is full or failingStorage and filesystemBackups failingBackup and VSSPatch broke somethingPatching and servicingAccount compromisedSecurity and identityNetwork flakyNetworkWhy is this server slowPerformance and capacityWhat changed on this boxConfiguration drift
Windows event log feeds · curated event streams
System log1 channel · 108 curated reasons
Application log1 channel · 47 curated reasons
Security log1 channel · 70 curated reasons
Microsoft Defender2 channels · 13 curated reasons
Windows servicingSetup log, CBS log, DISM log · 27 curated reasons
Device health topics, measured on the machine
StorageVolumes, Device IO, Devices, Storage IO, Volume map · 12 signals
Backup and VSSShadow storage, Writers · 2 signals
System identityMachine identity and posture, including whether a reboot is pending.
curated today (# of signals)drawn on for this answerno signal yetAll 49 feeds and topics, 8 themes
Connected to SparkLogs
Claude · Copilot · Codex · MCP
Answers name the sources they drew on.Connect your AI
Tracked problems

Track and correlate problems across time and severity on curated signals.

MonTueWedThuFriSatSun
patch window
now
Northridge
disk latency degradednr-fs-01
open 4d · subsiding
disk latency degradednr-app-02
cleared Sat
storage controller resetnr-db-01
5 occurrences
DCOM activation timeoutnr-dc-01
first seen · cleared
Lakeview
logon failed ×41lv-ws-114
Thu 3:39pm to 3:43pm
security agent service terminatedlv-ws-041
open 3d · unchanged
Kerberos PAC verification failedlv-dc-01
Thu 3:47pm
Harborview
IIS app pool failurehv-web-01
cleared · then again Thu
data volume space low · D:hv-fs-02
open 3d · rising
shadow copies failing for spacehv-fs-02
open
VSS writer failedhv-fs-02
SQL Server writer · nightly 01:58
audit log clearedhv-fs-02
Thu 4:02pm
NoticeWarningSeriousCriticaloccurrenceepisode, open to cleared
Connected to SparkLogs
Claude · Copilot · Codex · MCP

How it works

01

Capture

Our lightweight agent captures logs plus deep system state and health on every endpoint you manage; other data (e.g., firewall logs) can be ingested via open source shippers and protocols.

02

Curate

Each stream is analyzed in realtime and becomes named signals with graded severity and grouped into patterns. Notable conditions are tracked over time as problems arise.

03

Ask

Use your own AI systems (Claude, Codex, Copilot, any MCP). Run /sparklogs-investigate through MCP or the skills plugin. Analyze one device or 1000s. Every finding links to the data behind it for further inspection.

Foundation

Petabyte-scale data engine

Schemaless ingest with no indexes to configure. Query hundreds of billions of events in under 10 seconds. Explore with full-text search, adaptive-scale querying, histogram zoom, pattern analysis, and field pivots. Optionally replicate data to your own object storage archive.

Workloads and signals we monitor

All 49 feeds and topics
WorkloadSQL Server6 sources cover itWorkloadDomain controller4 sources cover itWorkloadDNS server2 sources cover itWorkloadHyper-V host5 sources cover itEvent feedSystem logThe System channel: service, driver, disk, network, cluster and hardware faults from the operating system itself.Event feedSecurity logThe Security channel: sign-in outcomes, privilege use, directory changes and audit policy changes.Device healthStorage5 sources · 12 signalsDevice healthBackup and VSS2 sources · 2 signals
A note from our founder

“We didn’t start with a product idea. We started with a problem we couldn’t put down.”

Twenty years building Axcient for 5,000+ MSPs meant fighting an ocean of logs every day. SparkLogs is the data layer we wished we had: petabyte scale, near zero overhead to manage, and with automatic pattern analysis and data extraction.

AI changed what one engineer can get done in a day, but an agent is only as good as the evidence it can see. Our mission: put the joy back into IT, so your team can deliver service clients rave about and be home in time for dinner.

Kevin Hoffman
Kevin Hoffman
Founder & CEOPreviously co-founder, Axcient
Our story
Ticket #4781 · same data, two paths
FILE SERVER IS INTERMITTENTLY SLOW
"Started this morning, no recent changes reported."
Manual today
Senior engineer, by hand
~60 min
With SparkLogs
Same engineer plus AI partner
~5 min
Time reclaimed12× faster
Find Out How

Make IT problems die young.

Learn about IT Fleet IntelligenceConnect your AI