Skip to main content
SparkLogs Foundry · Cohort intake open

Bring agentic IT diagnostics to your service desk.

An invitation-only program for MSPs to work with us on an IT fleet intelligence layer so engineers can close hard tickets in minutes, not hours. Built alongside the engineers who actually use it.

Learn More
diagnose a failing laptoplive demo
Watch a live investigation
A real SparkLogs MCP session with Claude
9 chapters~3 mininteractive
Open the demo

Make IT problems die young

IT Fleet Intelligence
Ask your fleet anything
- what new failures are happening this week we haven't seen before?
- strange IO slowdowns after patch tuesday. why? who's affected?
- we just fixed VPN flakiness on the lakeview ts. anyone else affected?
- bob's account got hacked at 3:43pm. audit everything. impact?
Any question, any scope
One host, one client, or the whole fleet
Logs plus deep system state
CPU, RAM, IO and disk trends, projected forward. Snapshots plus instant deltas: services and VSS, BitLocker, leaks and blue screens, patch and servicing state, installs, event logs
Answer the questions no one knows to ask
Spot issues emerging across the fleet before clients feel them
Learn about IT Fleet Intelligence
Agentic RCA · cited evidence
From question to root-cause and ticket-ready report
- ticket 7623 is off track. dig in and write it up
- backups failed on fs-02 three nights running. why?
- why is lakeview file server super slow every afternoon?
- why did dc-01 at northridge reboot at 2am last night?
The AI runs the investigation
It queries your fleet's evidence, follows what it finds, and returns root cause in minutes
Works where you work
Claude, Microsoft Copilot, Cursor, Codex, or your own MCP agents
Open-source skills, cited reports
/sparklogs-investigate writes the ticket-ready report; click any claim to verify the evidence; then dive deep into likely root causes and fixes
Connect your AI
A note from our founder

“We didn’t start with a product idea. We started with a problem we couldn’t put down.”

Twenty years building Axcient for 5,000+ MSPs meant fighting an ocean of logs every day. SparkLogs is the data layer we wished we had: petabyte scale, near zero overhead to manage, and with automatic pattern analysis and data extraction.

AI changed what one engineer can get done in a day, but an agent is only as good as the evidence it can see. Our mission: put the joy back into IT, so your team can deliver service clients rave about and be home in time for dinner.

Kevin Hoffman
Kevin Hoffman
Founder & CEOPreviously co-founder, Axcient
Our story
Ticket #4781 · same data, two paths
FILE SERVER IS INTERMITTENTLY SLOW
"Started this morning, no recent changes reported."
Manual today
Senior engineer, by hand
~60 min
With SparkLogs
Same engineer plus AI partner
~5 min
Time reclaimed12× faster
Find Out How

Petabytes of Log Data

Schemaless

Ingestion is "point and shoot" — fields don't have to be configured, just send data. Capture complex JSON data with each log event. No field limits.

AutoExtract

Auto-extract semi-structured and JSON data from plain text. Auto-detect field types. Auto-extract IP addresses, timestamps, and bracketed values.

Visual Data Exploration

Visualize patterns across billions of events.
Instant zoom-in, filter, search, and export.
Easily sift through huge query results.

Petabyte Scale

Fully managed in our cloud.
Always on, infinitely scalable.

Ingest Anything

Open-source ingestion agents for files, Kubernetes, syslog, journald, Kafka, Docker, and more.
OpenTelemetry, vector.dev, filebeat, Logstash, Alloy.
Or ingest via REST, OTLP/HTTP, or elasticsearch API.

Enterprise Ready

Data encrypted at rest and in-transit.
SSO in every plan. Role-based access control.
Optionally use your own Google cloud tenant.

Petabyte-scale Querying

Analyze datasets with 100s of *billions* of events in less than 10 seconds.
SQL-like query language with custom fields, array unfolding, and advanced operators.
Full-text index provides fast search over any time scale for “needle-in-PB-haystack” type searches.
Adaptive-scale querying to explore any time-scale in seconds, then easily zoom-in to refine areas of interest.
Example of Massive Scale Adaptive Querying Engine

How Ingestion Works

For the endpoints you manage, deploy the SparkLogs Agent via your RMM: it records logs plus the deep system state behind IT fleet intelligence.
Use your favorite open-source tools like OpenTelemetry, vector.dev, filebeat, Logstash, Alloy.
Or ingest via our open APIs: HTTPS/REST, OTLP/HTTP, elasticsearch, or Loki Push.
How Ingestion Works: (1) Organizations scope data. (2) Users are granted access to data at level of organizations. (3) Agents are logical API endpoints that belong to a single organization. (4) Any number of data sources can ship data to an agent API endpoint using log shippers like vector.dev, fluentbit, filebeat, Logstash, or directly via HTTP REST, elasticsearch, or loki protocols.

Zero Config + Schemaless + AutoExtract

No indexes to configure, no field schemas, no parsing rules. Point and shoot ingestion.
Infinite custom fields. Infinite cardinality. Send plain text or (semi) structured data.
AutoExtract structured data from plain text. Automatic category and pattern classification.
Automatic GeoIP lookups on IP addresses and foreign currency conversion.

Try it out for yourself on your own log line!

OpenTelemetry-Native Ingestion

Native OTLP/HTTP ingestion for OpenTelemetry logs, supporting JSON and protobuf payloads and eight compression encodings.
Works with the OpenTelemetry Collector, every OTel SDK (Python, Go, Node.js, Java, .NET, Rust, …), and any OTLP-compliant shipper.
Smart auto-derivation of three levels of pivot fields (source, service, app) from your OTel Resource attributes.
Built-in resilience: request dedup, clock-drift correction, and large payload support.
Schemaless and infinite-cardinality by design — your wide events stay wide.

Automatic Syslog Parsing

Automatic parsing of syslog data in known and unknown formats with zero configuration.
Supports RFC3164 (and its many variants), RFC5424, Linux, FreeBSD, and many proprietary
formats such as Cisco, Juniper, SonicWall, WatchGuard, Fortinet, and more!
Example of How Automatic Syslog Parsing Simplifies Configuration

Interactive Data Exploration

Interactive histogram with live zooming and instant severity filtering.
Filter by data hierarchy (organization) and data sources; pivot to filter on any field.
Explore events at any point within query time window, with infinite bi-directional scrolling.
Side-by-side context viewer (e.g., matching errors on left, surrounding full context on right).
Copy logs to clipboard or download first million matches with shareable link.
Example of Massive Scale Adaptive Querying Engine

Pattern Analysis

Automatically classify log events into prototypical patterns with zero configuration.
Identify top application error patterns, then pivot to see examples in context.
Analyze top 10,000 values for any (custom) field over any window of time.
Example of pattern analysis over automatic log classification field over a 1 day time period

Replicate to Your Data Lake

Replicate a copy of all your data to any cloud storage bucket.
Data is stored compressed in a ready-to-query Parquet hive-partitioned format.
Use to efficiently meet retention requirements of HIPAA, FINRA, SEC, or CFTC
while also delivering a queryable archive for forensics and analysis.

Unreal Engine Analytics & Logs

For game studios using Unreal Engine, collect & analyze analytics events at massive scale.
Use daily snapshots of analytics to optimize DAU, engagement, and revenue.
Gain full access to raw and snapshot data for your own machine learning models.
Ingest and query game logs from backend servers and dev environments.
Effortless implementation with our field-proven Unreal Engine plugin.