Release Notes

This page documents the latest changes and updates to SparkLogs. The application automatically updates to the latest version and cannot be downgraded. Backwards compatibility is a fundamental design principle to ensure that observability pipelines are not disrupted. Upgrades will not require changes to any ingestion pipeline or configuration.

Application v2026-11-05i - Device Timeline Enhancements for Crash History, Drivers, Devices and Shares

Features:

• See a device's crash history at any moment. The Crashes tab has a Crash history card with 1, 5 and 10-day totals for each kind of crash, with the programs and kernel signatures behind them. Pick a row to narrow the crash list to it. Copy link keeps your selection, so you can share what you are looking at.
• Drivers tab. One row per driver with its status, filter class, signing and recent driver changes.
• Devices tab. Browse hardware by type, problems first, or by connection as a tree. Links go both ways between devices and their drivers.
• Shares tab. Share permissions read as words, with the raw permission string beside them.
• Kernel memory on the RAM view. A Kernel memory lane and a table of pool tags show the largest and the rising kernel memory users.
• Updates sit under the product they patch. The Software tab nests each update under its product and shows the update type.
• Deep links into device timeline tabs. AI assistants can now easily deep link into a given tab and select a particular item instance.
• Hide routine maintenance. The Changes tab hides routine maintenance by default, toggled by a Maintenance chip. A Group repeats chip folds repeated changes together.

Maintenance & Improvements:

• The Processes tab has a Net column showing each process's TCP traffic.
• Network path charts consolidate probes into range-ticks when probes are dense visually.
• Custom time ranges accept phrases such as "last 24 hours" and "past 2 days".
• Change rows read more plainly: renamed drivers and products show their new versions, and an item such as service:Spooler reads "Spooler".
• The Findings drawer lists conditions before occurrences at equal severity and scrolls to the selected finding.
• Date-only fields show as the nearest UTC day, and the AI investigation prompt writes dates as the page shows them.
• Page guides can have several steps, with keyboard support.

Cloud Services v2026-11-05 - Current Device State for Your AI Assistant, Forced Field Types

Features:

• "What is my device like right now?" gets the current answer. For each topic, your AI assistant reads the newest inventory at or before the end of the time range, with later changes applied and removed items dropped. Each row carries the item's own data, such as a service's state or a product's version. A row changed after the inventory also shows the previous values of the changed fields. A topic that reported no items is marked empty. A topic with no inventory is unknown.
• AI answers link to the device page. Results include a link to the device, and the assistant can link to a listed item at a chosen time.
• Force a field's type at ingest. End a field name with #s, #n, #b, #t or #i to store it as text, a number, a boolean, a timestamp or digits-only text (see Forcing a Type with a Field-Name Suffix). A field name ending in a Unix epoch unit, such as _unix_ms, is read as a timestamp in that unit. A sender whose field names already end in one of these codes now gets the forced type, stored under the shorter name.

Maintenance & Improvements:

• AI answers mention data coverage only when a device reported under 89% of the time range.
• Fleet network rankings count every packet sent. Error, discard and Wi-Fi failure shares now include the lost traffic in the total. A device that lost all its traffic in a period shows at its highest share.
• Timestamp fields read digit strings by their shape, and fractional Unix epoch times are accepted.
• Long values in AI results keep their start when cut, and the result lists what was cut.
• Very large log searches retry with a smaller cache capture if they run short of worker memory.

SparkLogs Agent 1.14.10 - 1.14.11 (2026-11-05) - Telemetry for Kernel Drivers, Devices, Kernel Memory

Questions You Can Now Answer:

• Which kernel drivers are loaded, and are they signed? New kernel_drivers topic: one row per loaded driver with its file version, publisher, signer and signature status. New reasons show drivers that are installed, updated, loaded or unloaded. An unsigned or untrusted driver loading stands out with a higher severity. kernel_driver_flapping and kernel_driver_installed_repeatedly show drivers that keep reloading or reinstalling, and replace the stream of individual changes.
• What hardware does this device have, and is any of it failing? New devices topic: one row per device with its type, manufacturer, bus, vendor and product IDs, status and any problem code, linked to the kernel driver and driver package behind it. It covers hardware and the virtual devices that run a driver. Volume shadow copies and print queues are left out.
• What is using kernel memory? New top_kernel_memory topic: the largest pool tags, paged and nonpaged, and the tags whose daily low keeps rising, with the drivers most likely to own them.
• Is memory integrity on? New memory_integrity_enabled in system_info: true when Windows memory integrity is enforcing on kernel code.
• Which crashes is this condition counting, and when was the last one? Conditions that count events (recurring app crashes, recurring blue screens, service crashes, failed shadow copies, out-of-memory crashes) now say what they count and when the newest counted event happened. The app and your AI assistant use this to show the crashes behind "4 in 24 hours" and open them directly. New fields kernel_crash_last_ts and ram_oom_crash_last_ts hold the time of the latest blue screen and out-of-memory crash.
• Who installed this software, and when? Installed products now include the install folder and install date. A per-user install shows the user's profile folder.

More Accurate or Quieter:

• Collection status for devices that sleep or restart often is more accurate.
• Coverage reads whole unless a window was really missed. window_coverage_pct reads as 100 percent when no capture was missed.
• Product upgrades are recorded as one change. When a product's name carries its version (such as "7-Zip 23.01 (x64)" becoming "7-Zip 24.08 (x64)"), the upgrade is one product changing version, recorded as maintenance, instead of a removal plus a new install. Products installed side by side, such as several .NET or Visual C++ runtimes, stay separate.
• A failed shadow copy writer that disappears is held, not dropped. When a failed writer leaves the writer list (for example because its service stopped), its condition stays open for a while: if the writer comes back healthy it ends as recovered, if it comes back failed it stays open, and if it stays away it ends as no longer applicable.
• Unreadable volumes say why. The start of volume_unreadable names the volume's state, for example raw.

Maintenance & Improvements:

• The agent keeps writing its own log after a failed open or write, retrying every few seconds.

Data Feed Pack 1.12.7 - 1.12.8 (2026-11-05) - Kernel Drivers, Devices and Kernel Memory, Quieter Driver Installs

Features:

• New references. Topic and field references for kernel_drivers, devices and top_kernel_memory, and reason pages for the new kernel driver reasons.

More Accurate or Quieter:

• Kernel driver installs leave the Changes view. Service Control Manager event 7045 for a kernel driver is now low-severity evidence: the agent reports the install as kernel_driver_installed, and a tool that reinstalls a driver every minute becomes one kernel_driver_installed_repeatedly condition. Installs of ordinary services are unchanged.
• Storage summaries drop only on a real zero. Storage latency and StorPort error summaries are dropped only when their count reads zero, and a record whose count cannot be read is kept.

Maintenance & Improvements:

• Device state references updated for SparkLogs Agent 1.14.11.

SparkLogs AI Plugin 1.12.8 (2026-11-05) - References for Data Feed Pack 1.12.8, Device Links

Features:

• Reference material for Data Feed Packs 1.12.2 to 1.12.8 and SparkLogs Agent 1.14.11. Feed, field and condition references cover the kernel_drivers, devices and top_kernel_memory topics and every event reason and field explanation added since 1.12.1.
• Answers link to the device. Skills cite device page links and query URLs instead of bare IDs.

More Accurate or Quieter:

• Answers no longer qualify on data coverage unless a device really reported for under 89% of the time range. Time asleep or powered off is stated as device state when it matters.

Maintenance & Improvements:

• Skills now carry the investigation workflow, and tool behavior lives in the tool reference.

SparkLogs Agent 1.14.8 - 1.14.9 (2026-11-02) - Collector Health, Reason and Field Documentation

Questions You Can Now Answer:

• Is the data collector hung or stalled? The agent now watches the data collector and reports collector_stopping_hung when it does not stop when asked, and collector_stalled when it runs but no longer moves data.
• What does each condition mean, and how does it end? Every reason in the device state reference has an explanation, what to check, how it ends, and a worked example.

More Accurate or Quieter:

• collector_down waits for a collector that stays down. It opens after about 12 minutes of failed restarts (up from 3 minutes), so a collector that is slow to restart no longer raises it. Feeds still show behind or stuck on their own schedule in the meantime.
• Expired Windows Update pauses no longer read as paused.

Maintenance & Improvements:

• Every device state field reads plainly. Field descriptions say what the value is, its unit, where Windows reports it, and when it is absent.
• Related fields are linked. A field that only appears with another, or counts part of another (such as failed test pings out of all test pings), says so in the reference and links to that field.
• The closing message of a condition counts the times it came back.
• Shutdown, restart and stop handling of the data collector is more reliable.

Data Feed Pack 1.12.5 - 1.12.6 (2026-11-02) - Practical Documentation for Every Event Reason and Field

Questions You Can Now Answer:

• What does this event mean, and can I ignore it? Every event reason in the feed reference explains what happened, why it matters, what to check, and when the record is routine and safe to pass over.
• Is another device using this machine's IP address? New ip_address_conflict_detected (Tcpip 4199, DHCP client 1005).

More Accurate or Quieter:

• Renamed reasons. Update saved searches and alerts that name the old reason:
  • failover_cluster_quorum_loss is now failover_cluster_node_config_stale (FailoverClustering 1561: this node lacks the latest cluster configuration, so its cluster service will not start), rated Error instead of Severe.
  • sparklogs_agent_event_truncated is now sparklogs_agent_event_too_large_dropped: the agent drops an oversize event whole.
• NPS lockouts match account lockouts. nps_lockout (NPS 6279) now rates the built-in Administrator at Warning and every other account at Error, the same as account_locked_out (Security 4740). Steady Administrator lockouts usually mean the name is exposed to password spraying through RD Gateway or remote access.
• AD CS revocation list failures. Certification Authority events 65, 66 and 75 now land in adcs_crl_publish_failed.
• BitLocker. Event 2903 is classified without matching localized text, and 2904 is kept at Notice.
• Narrower matches. More precise matching for storage_controller_reset and for certain CBS logs.

Maintenance & Improvements:

• Improved field documentation. Field descriptions are improved, and each feed's fields are grouped (for example SMB client, BitLocker, Group Policy).
• Each reason and topic has its own data file under /reference/reasons/ and /reference/topics/, for tools and AI assistants.
• SMB slow-operation times are in milliseconds, and wlan_reason_code (WLAN-AutoConfig 11006) is parsed properly.
• Device state references are synchronized with SparkLogs Agent 1.14.9.

Application v2026-11-02q - Better Display of Conditions, a Faster Device Page

Features:

• Condition details lead with what is happening. Each condition explains what it means, how it ends, the time its values were reported, and a link to its reference page.
• Better UX for recurring-crash conditions. It's now easy to see which app crashed, how often its crashing, and when it last crashed. Each counted crash is marked on the timeline, and "Show these crashes" opens the Crashes tab filtered to them.
• Better agent status reporting. The agent list shows when the data collector is hung or stalled, when a data feed pack needs a newer agent, and when collection is paused.

Maintenance & Improvements:

• The device page loads faster and is more responsive.
• On charts showing network probes (Internet pings), closely spaced probes collapse into a bar showing min/max and median; failures are always marked.
• Mouse hover overlays were added for all network path charts.
• The app loads faster and has a new loading screen.
• If the app has an unrecoverable error, you can now easily report this with the logs.

Application v2026-10-30u - Faster App, Condition Lifecycle at a Glance, and Clearer Changes

Features:

• A faster app. Pages, tabs and charts respond faster in supported browsers (those that support WASMGC).
• See where each condition stands in its lifecycle. The device page now shows each stage: open, improving ("Subsiding"), clearing up (since when, and about how long until it closes), and "Held again" if it returns before it closes. A condition that is clearing up no longer counts toward a device's attention, and Fleet Health shows these apart, for example "3 open (1 clearing)".
• See a device's state at any point in time. Pick any moment on the timeline, and each condition shows the values the device reported then, such as free disk space or available RAM, next to the limits that trigger it.
• Jump straight to when it happened. Click any step in a condition's history to see the whole device's state at that moment.
• Changes that matter stand out. Repeated changes to the same item are grouped with a count, and routine maintenance such as updates shows as grey bars on the timeline. A real configuration change just before a problem is much easier to spot.

Maintenance & Improvements:

• Problems that started before the time range you are viewing now show from the start of the timeline, so they are not missed.
• A DNS filter that blocks the test lookup no longer looks like a DNS outage, and the Network tab explains what a DNS filter is.
• When a Wi-Fi driver does not report retry statistics, the Network tab says so.
• Connections flagged "May be struggling" show the evidence behind the flag.

Cloud Services v2026-10-30 - Device Overviews for Your AI Assistant, Condition Lifecycle, Fleet-Wide Performance

Features:

• Ask "what's wrong with this PC?" and get the whole picture. Your AI assistant can pull a device's full health (CPU, memory, disk, processes, storage, problems and recent changes) or its network (Wi-Fi, gateway, internet and DNS checks, connection quality) in one step. It works for up to 25 devices at once, and the assistant can dig into the details without starting over.
• Your AI assistant knows where each condition stands. It can tell an ongoing condition from one that is clearing up, say since when and about how long until it closes, and leave clearing conditions out of fleet rankings and "what needs attention" answers.
• Compare any performance reading across your fleet. Ask which devices have the worst Wi-Fi retries, internet latency, failed network checks or memory pressure, for one client or all of them.
• Clients with several sites or departments. Name a parent organization, and your AI assistant sees its child organizations and how many devices each has.
• Readable messages from .NET apps. AutoExtract detects and parses .NET log formats automatically. .NET apps that log to the Windows event log (such as ImmyBot) now show their real message, the component that logged it and the exception type (see .NET Logger Messages).

Maintenance & Improvements:

• Recent configuration changes now reliably appear when your AI assistant asks for a device's current state.
• A DNS filter that blocks the test lookup no longer counts as a DNS failure.
• Device readings say when a Wi-Fi driver does not report retry statistics.

SparkLogs Agent 1.14.6 - 1.14.7 (2026-10-30) - Conditions That Are Clearing, Chassis and Domain Join Type

Questions You Can Now Answer:

• Is this condition getting better? A health condition that is now fully recovered and waiting to clear during its recovery dwell time has better reporting and will report at Notice severity. If the problem comes back before the condition closes, it returns to its full severity. The device timeline and your AI assistant use this to tell an ongoing problem from one that is going away.
• What kind of machine is this, and how is it joined to a domain? New host facts: chassis_type (virtual, portable, desktop or server) and domain_join_type (workgroup, Entra, Active Directory or hybrid). A change of join type is recorded as a domain change.

More Accurate or Quieter:

• Every open condition reports on each inventory, including ones the agent could not check that time, so a condition never looks closed just because it went unchecked.
• Wi-Fi drivers that do not keep retry statistics now read unsupported instead of reporting zeros.

Maintenance & Improvements:

• A failed agent self-update reports which installer step failed and details from the installer log.
• The DNS zone used for probes is recorded when a probe comes back as redirected or filtered.

Data Feed Pack 1.12.3 - 1.12.4 (2026-10-30) - New Domain and Group Policy Events, Quieter PowerShell and Security Feeds

Questions You Can Now Answer:

• Can the machine set up its secure session with a domain controller? New domain_secure_channel_failed (NETLOGON 5719).
• Did a Group Policy software install fail? New group_policy_software_install_failed, naming the policy extension.
• Which database is corrupt? ESENT corruption events now name the database. Windows caches such as the Search index are Warning; server role databases such as ntds.dit, DHCP or a certificate authority are Serious.

More Accurate or Quieter:

• PowerShell: routine classic PowerShell events are kept at Debug, and a script block that runs over and over (common with RMM tools such as Datto RMM) is kept to one row every 15 minutes with a repeat count. A new or changed script is always kept in full.
• Security and platform: Code Integrity audit floods, firewall rule upkeep, and Secure Boot update retries are kept to one row per item per day or hour.
• Password resets: every completed reset (Security 4724) is Notice.
• Scheduled tasks: tasks created or changed by system accounts are recorded as maintenance, not configuration changes.
• Group Policy 7320 is curated as Info for a workgroup or an Entra-joined machine that has no domain controller.

Maintenance & Improvements:

• Device state references updated for SparkLogs Agent 1.14.7.

SparkLogs Agent 1.14.5 (2026-10-28) - Improved Network Monitoring, DNS Filters, Faster Probes After Start

Questions You Can Now Answer:

• Is a DNS filter blocking the probe name, or is DNS being redirected? When the DNS probe's answer comes from outside the expected addresses, the agent now also looks up a well-known address like google.com. If that answer is normal, the probe entry reads filtered: a DNS filter blocks the probe name, so dns_lookup_redirected does not open. A filtered lookup is not a failure and shows the DNS server is answering, but it carries no DNS latency. Redirected and filtered entries carry the off-list answers in answer_a and answer_aaaa (at most 2 each, under the agent's destination address policy), with answer_a_class and answer_aaaa_class saying whether they are private addresses (non_public) or public ones not on the expected list (off_list_public).

More Accurate or Quieter:

• Tuning how struggling TCP connections are identified. In top_network_connections, the top_by value unhealthy is renamed struggling. The algorithm has been tuned to consider the number of (consecutive) retransmit timeout, its resend and data rates, and stall mechanics. This prevents inert connections (like idle keep-alive) from being labelled as struggling.
• Probes start sooner after the agent starts. The first network probes now run 1 to 2 minutes after the agent starts (as long as the device has settled after waking up).
• Probe timing coherence. Probes scheduling has improved so that random jitter happens within instead of across each measurement window. At the default 5-minute interval every performance window counts exactly one gateway, internet and DNS probe.

Maintenance & Improvements:

• tcp_<class>_rttvar_ms_avg is the average of each connection's round-trip variation over the reading.

Data Feed Pack 1.12.2 (2026-10-28) - Quieter Audit Policy Re-Applies

More Accurate or Quieter:

• Security 4719 (system audit policy changed) that are related to Group Policy re-applies on its refresh cycle are kept at most once a day per audit subcategory and change. Audit policy changes made for any other reason are unthrottled and still recorded as a audit_policy_coverage_reduced configuration change.

Maintenance & Improvements:

• dns_lookup_redirected explains the new filtered DNS outcome.
• Device state references updated for SparkLogs Agent 1.14.5.

Application v2026-10-27k - Device Health Network Diagnostics and Performance

This release has adds network performance and health to the device timeline:

Features:

• Path quality. The Network tab opens on one chart per network segment: Link (Wi-Fi or Ethernet), LAN/Private, VPN, Internet and DNS. Each row shows TCP round trip and jitter from the device's real traffic, the agent's gateway, internet and DNS probe results, and the network occurrences and conditions on that segment. Probe outages the agent confirmed appear on the segment they hit.
• Network card on the Overview. One row per segment shows its state at T in plain words ("OK 1 Gbit/s", "No answer 29 min", "Hot -74 dBm · retry 34%"), typical probe latency, the adapters, network occurrences and the latest configuration changes.
• Network throughput by kind. Throughput splits into LAN/Private, VPN and internet traffic. The Network tab charts TCP health (round trip, jitter, queueing, upload resends, download loss) and Wi-Fi quality (signal, retries) over time, and its connection table shows each connection's rate. Download loss is measured in loss episodes per 1,000 segments received.
• Network on the timeline. A NET lane marks network trouble, confirmed probe outages and periods when no network link was up.
• Heat in words. Heat reads OK, Warm, Hot or Very hot everywhere, and a hot reading names its root cause(s).
• Network traffic by process. The Processes chart has a network mode, and the timeline's network card lists the top processes by TCP traffic at T.

Maintenance & Improvements:

• Network adapter and network setting changes have their own Network row in the timeline's Changes section.
• The Processes chart has a RAM mode that replaces the separate CPU and memory by-process views.
• Queueing delay, stalled connections, jitter from few samples and Wi-Fi retries alone read at most Warm, and upload resends under 64 KiB read at most Hot.
• Disk charts name the busiest disk.

SparkLogs Agent 1.14.4 (2026-10-27) - Network Outages, Loss and Latency, Repeat Blue Screens

Questions You Can Now Answer:

• Was this site's internet down, and for how long? Every 5 minutes the agent pings the default gateway and an internet target (based on agent policy) and looks up a DNS name. After a failed probe, up to 3 follow-up probes run about 30 seconds apart. gateway_probe_down_s, internet_probe_down_s and dns_probe_down_s count the seconds between failed probes with no sign of a working network in between. An outage that continues reads the full 5 minutes in every reading until the network answers. The device page Network tab and timeline show these outages, and query_device_health returns them to your AI assistant. Down time is a lower bound: a single failed probe adds nothing, and time after the last failure is not counted. Bad looks like: down seconds climbing at the same time on several devices at one site.
• Is the problem the local network, the ISP or DNS? A failing gateway points at the LAN or Wi-Fi. An answering gateway with a failing internet target points past the site's router. DNS failing alone points at the DNS servers. The DNS probe looks up a fresh random name under conncheck.itlightning.app, and a lookup of google.com discriminates zone-specific DNS issues. DNS down time counts even while the device's other traffic keeps flowing. dns_lookup_redirected opens when a DNS filter or captive portal answers with other addresses. network_ipv6_broken opens when IPv6 internet pings fail at least half the time for 30 minutes while IPv4 works, which stalls applications that try IPv6 first. Each performance reading also counts DNS lookup timeouts (DNS Client 1014) and Windows reporting lost internet access (NCSI 4042).
• Is this PC's upload or download losing packets? Upload loss is the data this device had to send again, per route: LAN/Private, VPN and internet. Download loss is duplicate-acknowledgment loss episodes per data segment received, counted only on connections that received material data in the 5-minute window. Both show on the Network tab segment rows and in query_device_health. Download loss reads low on long-distance bulk transfers, where several losses close together count as one episode. Bad looks like: resends or loss on the internet route with a clean LAN route (the internet link), or loss on every route at once (start with the device's own Wi-Fi or cable).
• Is latency bad on the LAN, VPN or internet? Each route reports TCP round trip and jitter from the device's real traffic, weighted by the data each connection sent. Queueing is how far round trips rose above each connection's own lowest, so it climbs on a congested link. It appears only while enough data flows. Connections over a VPN adapter count as VPN, and office, home and VPN networks are reported separately. Bad looks like: queueing rising on the internet route during business hours, the usual sign of a full uplink.
• Which app or destination is stalling? The top_network_connections topic lists, every 5 minutes, the TCP connections that moved the most data, including ones that closed during the window: owning process, destination and port, bytes each way, resend share and round trip. Up to 5 more rows tagged unhealthy list connections that hit a retransmission timeout, or resent at least 2% of 64 KiB or more. Agent policy determines the recording precision of remote IP addresses; by default only the network (/24 for IPv4, /48 for IPv6) is recorded, and this can be changed to exact addresses, a random ID per address, or not at all (and aggregate remote connections by process instead). LAN destinations are recorded precisely. Processes are also ranked by TCP traffic. Bad looks like: one process timing out to one destination while other connections are clean, which points at that server or that app.
• Is Wi-Fi the problem? The network_adapter_io topic reports each adapter's traffic, utilization, errors and discards every 5 minutes. For Wi-Fi it adds band, radio type, signal, retries, frames lost after all retries and channel changes, which catch most access point roams. Each performance reading counts Wi-Fi disconnects by the driver (WLAN AutoConfig 8003). Bad looks like: weak signal with high retries and lost frames, or repeated driver disconnects.
• Did a link drop, slow down or fill up? Each reading reports the seconds no physical adapter had a link, when those drops happened and how often a link went down, with packet counts per adapter. network_adapter_saturated opens when the busiest wired adapter on a physical machine runs at 80% of its link speed for 15 minutes (Display) or 90% (Notice). Bad looks like: link-down seconds on a desk PC, usually a cable, port or dock.
• What changed on the network? The network_shares topic lists each SMB share with its path, type and permissions. network_share_added, network_share_removed, network_share_path_changed and network_share_permissions_changed arrive as configuration changes at Notice, and a reboot with the same shares reports no change. network_context_changed (Display) records a move to a different primary network, with the adapter, connection type (wired, Wi-Fi, cellular or VPN), gateway and DNS suffix before and after.
• Is this machine blue-screening repeatedly with the same stop code? kernel_crash_recurring opens at Display at 2 kernel crashes in 30 days, so the same bug check two weeks apart shows up. It closes after 30 days without a kernel crash (was 20). The message names the stop code most of the crashes share, counts them in plain words ("3 kernel crashes in the last 30d (threshold 2)") and says how many crashes are still being analyzed. Crash occurrences name the crashing executable.
• Why does this machine keep waking up when nobody is around? power_wake_loop (Display) opens when a device wakes from sleep on its own 8 or more times an hour for 2 hours, and closes after 2 quiet hours. A wake timer or a USB device allowed to wake the machine is the usual cause.
• Is this virtual machine on a slow emulated network adapter? network_adapter_emulated opens when a connected adapter on a virtual machine uses an emulated NIC model, such as an Intel E1000 or the Hyper-V legacy adapter. It is Notice on Hyper-V and VMware, which always offer a paravirtual adapter, and Display on other hypervisors.

Maintenance & Improvements:

• A gateway that does not answer ping is properly marked as "not answering"; a gateway that newly starts allowing ICMP pings is also handled.
• A probe the local firewall blocks counts as a failed probe.
• Retransmission timeouts count only connections that were sending data, so failed connection attempts and keep-alives add none.
• network_ipv6_broken no longer opens on a machine whose only IPv6 runs over Teredo, 6to4 or ISATAP tunnels.
• Address changes on host-internal virtual adapters (Hyper-V Default Switch, WSL, VMware, VirtualBox, Docker) are no longer configuration changes (these often readdresses themselves at every boot).
• network_adapter_dhcp_failed no longer opens on USB RNDIS adapters, such as payment terminals and phone tethering, or when the agent cannot read whether the adapter uses DHCP.
• The Npcap loopback adapter is classed loopback, and the extra ports of a Wi-Fi radio are virtual, so one radio counts as one physical adapter.
• A laptop that wakes and sleeps repeatedly no longer re-sends certain inventory records more frequently than they should.
• The feed telemetry for Windows event log is more accurate by considering event exclusion filters properly.
• Windows own service start type changes to BITS, IsolationSession and TrustedInstaller are no longer recorded as configuration changes.
• An audit policy change is confirmed by a second read about 5 minutes later, so a read taken while Group Policy reapplies no longer reports a reduction followed by a restore.
• The summary message is improved for kernel crashes, repeated application crashes, and service flaps.
• A slow shadow copy check no longer delays crash or Windows Update collection.
• The checks for service crashes, out-of-memory errors, resource exhaustion and shadow copy errors read the event log incrementally.
• The collector runs at below normal priority, and Data Feed Pack updates cause shorter collection gaps on busy machines.
• The agent keeps running when the disk under its state store fails or the store file is damaged, and writes Windows Event Log entries when the store degrades and recovers.
• Fixes to handle older telemetry data that is already queued for sending after a long device sleep or hibernate.

Requirements and Notes:

• If a DNS filter in front of your clients blocks unknown names, allow conncheck.itlightning.app and its subdomains if you want DNS probes to work.
• network probes by default are sent every 5 minutes to the gateway, internet, and DNS; these are "ping" checks and carry no system-specific data. Agent policy can switch each probe off and change its interval: 1 minute to 1 hour for the gateway and internet probes, 5 to 15 minutes for DNS. Agent policy can also change the DNS names and the internet ping targets.
• Network loss, latency and connection readings cover TCP only (no visibility for UDP and QUIC traffic).

Data Feed Pack 1.9.2 - 1.12.1 (2026-10-27) - QuickBooks, DNS and Wi-Fi Events, Network Shares

These packs work with SparkLogs Agent 1.13.0 and later.

Questions You Can Now Answer:

• Is QuickBooks crashing or having other material problems? QuickBooks writes everything from routine printer chatter to company-file advice as the same Application event 4. The pack now curates these events and records the QuickBooks edition in the field quickbooks_edition. A QuickBooks application crash is curated as app_crash at Minor. A request to run Verify on the company file arrives as quickbooks_verify_database_advised at Error. The advice does not confirm damage by itself: follow the QuickBooks Verify Data steps and take a backup before any rebuild. A bank feed decryption failure is an Error. A refused database login is a Warning. Printer failures are Display or Notice, and routine printing, cache and connection messages are Debug or Verbose. A unrecognized QuickBooks event (such as one in another language) stays at Warning.
• Are DNS lookups timing out? DNS Client event 1014 arrives as dns_client_resolution_timed_out at Display (was Warning), at most once per name every 15 minutes. One timeout on a waking or roaming laptop is routine, and many names timing out together point at the device's DNS servers or the path to them.
• Is Wi-Fi disconnecting? WLAN AutoConfig event 8003 arrives as wlan_disconnected (Notice) when the adapter's driver dropped the connection, and as wlan_disconnected_by_request (Display) when a user, a policy or a switch to another network ended it.
• Did Windows lose internet access? NCSI event 4042, where Windows marks an interface as dropping from internet access to local only or none, arrives as ncsi_internet_lost: Notice on workstations, Warning on servers. It records the status Windows assigned and a device with IPv4 and IPv6 can record one loss twice. The agent's probe down time confirms whether the internet was down.
• Is a disk predicting its own failure? Disk event 52 from the System log arrives as disk_failure_predicted: Serious on servers, Error on workstations.
• Who changed a network share? The four network share change reasons are Notice by default and can be set from Info through Warning. Security 5142 (a share published) is no longer a configuration change, since Windows republishes every share at boot. It is Info when SYSTEM published the share and Warning for any other account.

More Accurate or Quieter:

• PowerShell script block 4104 is Warning only for deleting shadow copies or backups, clearing event logs, wiping disks, adding Defender exclusions and credential tools. Other watchlist hits are Notice, and framework blocks are Verbose.
• Very large merged PowerShell script blocks are scanned in under a second, where they could take minutes of collector CPU.
• Windows creates and deletes temporary Sandbox.{GUID} firewall block rules for app sandboxes, such as those AI coding agents use. When the Windows Firewall service makes such a rule, its created (2097) and deleted (2052) records are Debug and marked as maintenance.
• Security 4724: SYSTEM resetting the password of the local ltservice account or the built-in Administrator is Notice.
• Security 4657 under the WMI registry key: writes by SYSTEM are Verbose, at most one per key and value an hour. Setting Enabled or Start to 0 stays Warning.
• AppLocker 8003 (managed installer and DLL rules) and 8033 are Info, at most one per file a day, and 8031 is dropped.
• DMS database errors (101) ship at most once per error every 10 minutes, and SQL Server login failures (18456) at most once per login a minute.
• Firewall changes by SYSTEM are routine upkeep unless made through a script or admin tool, now including wscript, cscript and mshta.
• DCOM 10010, Entra certificate refresh, WUDFRd 219, Group Policy 1252 and two routine Defender start failures are no longer Warning.
• NTFS event 98 is part of filesystem_corruption, and vss_shadow_aborted also covers shadow storage that could not grow.
• sparklogs_agent_spool_dropped says the oldest unsent file was dropped to stay under the spool size limit.

Maintenance & Improvements:

• The network topics, readings and conditions from SparkLogs Agent 1.13.2 to 1.14.4 arrive under the networking and file_sharing services: network_adapter_io, network_path, network_shares, top_network_connections, TCP traffic on top_processes, network_context_changed, network_adapter_saturated, network_ipv6_broken, dns_lookup_redirected, network_adapter_emulated and power_wake_loop.
• Device state references updated for SparkLogs Agent 1.14.4, including the five-minute probe defaults and their allowed ranges, how probe down time is counted, and the Display level of kernel_crash_recurring.

SparkLogs AI Plugin 1.12.1 (2026-10-27) - References for Data Feed Packs 1.9.1 to 1.12.1

Features:

• Reference material for Data Feed Packs 1.9.2 to 1.12.1 and SparkLogs Agent 1.14.4. Feed, field and condition references cover the network_path, network_adapter_io, network_shares and top_network_connections topics, the network share changes, moves to another network, dns_lookup_redirected, network_adapter_saturated, network_ipv6_broken, network_adapter_emulated and power_wake_loop.
• Windows event references. DNS lookup timeouts, Wi-Fi disconnects, lost internet access, predicted disk failure, QuickBooks company-file advice and SQL Server login failures.
• Reference material for Data Feed Pack 1.9.1 and SparkLogs Agent 1.13.1. Feed, field and condition references cover the DHCP failure and wired link slowdown conditions, static DNS and gateway changes, adapter types, configuration change names and observes_config_changes.

Maintenance & Improvements:

• The device state guide explains episodes that end because a condition no longer applies, how to name and group configuration changes, and how to filter network adapters by type.

Cloud Services v2026-10-26 - Network Evidence for Devices and AI, Faster Device Charts

Features:

• Network evidence in query_device_health. Device readings from SparkLogs Agent 1.14 carry per-segment TCP round trip, jitter, resends after ACK timeout and connection counts (LAN/Private, VPN, internet), gateway, internet and DNS probe results with their typical latency, confirmed probe-down seconds, physical link-down time, Wi-Fi signal and retries, and DNS timeout, Wi-Fi disconnect and lost-internet counts. Each field is described for your AI assistant, including when it can be absent.
• Memory pressure readings. Device readings carry commit charge against the commit limit, standby and modified memory, and hard faults per second.
• Network traffic by process. top_processes_over_time ranks processes by TCP traffic received and sent.
• New device state topics. network_shares and top_network_connections are listed for your AI assistant with the other device state topics.

Maintenance & Improvements:

• Device charts load faster: the device page reads its main series and its network detail separately, and the main series query compiles faster.
• Ingestion handles a stalled storage write better.

Application v2026-10-22k - Device Time Machine Overview, Touch Screen Support

This release polishes the device timeline page within the fleet view:

Features:

• Overview tab. The device page opens on an Overview of the device at T: a system headline, the open conditions in one grid, and cards for memory, I/O and the top processes.
• Copy and investigate from every tab. Each tab copies what it shows (conditions, changes, crashes, storage, state tables, logs, PowerShell, signals) as a table with UTC times and a summary line. Investigate on any tab copies the same investigation prompt as the header, naming the rows you selected. Device values in the prompt are marked as untrusted data, so a log line cannot pass as an instruction to your AI assistant.
• Crashes grouped by signature. Repeats of the same crash collapse into one row with its count.
• PowerShell in one grid. Recorded scripts and commands share one grid with kind chips and two-line previews, and a receipt opens the original script.
• Filter state tables. Processes, services, software, drivers and other tables have filter chips that show how many rows each one matches.
• Changed items by name. The Changes tab names each item by the name the SparkLogs Agent reported, such as a service's display name, instead of its internal identifier.
• Agents behind their release ring. A device's icon carries a dot when its SparkLogs Agent is older than the latest version on its release ring, and the tooltip names both versions.
• Touch screens and tablets. Two fingers pan and pinch-zoom the timeline and charts, grips are sized for a finger, and chart tools stay visible without a mouse.

Maintenance & Improvements:

• The timeline can be full, compact or collapsed to one line.
• On narrow screens the device header drops the range text before the device name wraps.
• Zooming the Logs histogram zooms the page's range, and selecting a log row no longer moves T.
• Each tab keeps its selected row when you switch tabs and come back, and Back returns to the previous T, tab and selection.
• The All process I/O chart on the Performance tab shows I/O by process, including processes outside the top list.

Cloud Services v2026-10-22 - Numeric Grouping, Fewer Duplicate Events

Features:

• Group by numeric fields. query_logs and App Analytics queries can now group by number fields such as status codes or event IDs.

Maintenance & Improvements:

• A SparkLogs Agent upload retried after the device's IP address changed (VPN, roaming, NAT) is recognized as a retry, and its events are stored once.
• Performance windows on the device page are marked partial only when less than 89% of the window was watched.

SparkLogs Agent 1.13.1 (2026-10-18) - Network Conditions, Named Config Changes, Lighter Crash Collection

Features:

• DHCP failures and slow wired links are conditions. network_adapter_dhcp_failed opens when a connected adapter that uses DHCP holds only a self-assigned 169.254 address for 5 minutes. It rates higher on a server, and when the device has no other default route and so is offline. network_adapter_link_downshifted opens when a wired link runs at half or less of the fastest speed it held in the last seven days, which usually points to a cable, port, dock or power setting. Both end with sparklogs.episode.end_reason no_longer_applicable when the adapter disconnects, so an unplugged adapter does not read as fixed.
• Adapter types. Each network_adapters row has an adapter_class: physical, virtual_switch, virtual (such as VPN and Wi-Fi Direct adapters), tunnel, miniport, loopback or not_present. Rows list the most important adapters first, and messages lead with the adapter that carries the default route.
• Configuration changes name the changed item. sparklogs.config_change.target_name carries the display name of the service, driver, product, network adapter or storage device at the time of the change. Every inventory carries sparklogs.observes_config_changes, which says whether the agent can report changes on that topic, so an empty change history can be read correctly.
• Network configuration changes follow what an administrator set. Changes to static DNS servers and the static default gateway are new configuration changes. A route or DNS move caused by a VPN connecting or new DHCP values is a state change whose message names the move, not a configuration change.

Maintenance & Improvements:

• Condition timing is more accurate after sleep, agent restarts and clock changes: a condition no longer opens or moves up a level one reading late, and a condition that clears and comes back starts its clock at the right time.
• Network collection stays current on busy machines, and a device no longer re-sends an unchanged network inventory after a short pause in collection.
• Performance windows are marked partial only when a reading was missed or a restart cut into the window, so a fully watched window reports full coverage.
• Crash collection reads only the crash records written since its last pass, so it does far less work on busy machines.
• A changed service command line shows the part that differs instead of cutting both values short.
• After the upgrade, open conditions carry over, and the first network reading does not report configuration changes it cannot confirm.

Data Feed Pack 1.9.1 (2026-10-18) - Network Conditions and Named Config Changes

Pack 1.9.1 works with SparkLogs Agent 1.13.0 and later. On each release ring the pack is published before SparkLogs Agent 1.13.1.

Features:

• Network conditions and changes. network_adapter_dhcp_failed, network_adapter_link_downshifted, network_adapter_static_dns_changed and network_adapter_static_gateway_changed arrive under the networking service, at the severity the agent assigns.
• Windows-recorded changes carry a name. Service installs (System 7045, Security 4697) and firewall rule changes set sparklogs.config_change.target_name when Windows records a readable name.

Maintenance & Improvements:

• A condition that stops applying to its subject, such as a disconnected network adapter, closes as ENDED with sparklogs.episode.end_reason no_longer_applicable, never as RECOVERED.
• Device state references updated for SparkLogs Agent 1.13.1: adapter types, the readings behind the new network conditions, target_name and observes_config_changes.

SparkLogs Agent 1.13.0 (2026-10-17) - Network Inventory, Conditions on Observed Time, Disk Latency and Service Tiers

Features:

• Network adapters and settings. New network_adapters and network_config topics report each adapter's link state, filter drivers and addressing, the default routes, the DNS suffix and the machine proxy. Changes to these arrive as configuration changes, as do changes to BIOS, boot mode, processor, installed memory, page file, crash dump type, domain membership, storage devices and virtualization.
• Sleep and data gaps no longer open or close conditions. Time-based thresholds count only the time the agent watched the device while it was awake. A condition open when a laptop goes to sleep stays open, gains no time while the laptop sleeps, and closes only when the agent sees it clear. Each episode reports its watched and unwatched time in sparklogs.episode.observed_s and unobserved_s.
• Tuned severity for disk and service conditions. A condition climbs as the evidence grows: how close a volume is to full, how long a service has been down, how often a crash repeats. Most minor conditions open at Display, and many start one level higher on a server.
• Hung and crash-looping services have their own conditions. service_stuck_pending opens when a service sits in one start or stop step without progress. A service that keeps crashing and restarting is service_flapping, not a stopped service.
• Disk health is judged on the physical disk. disk_latency_degraded now opens on the disk, so a failing disk with three volumes is one condition. It counts five-minute windows where IOs take a second or more while few IOs are waiting. disk_unresponsive opens when IO is waiting and nothing completes. disk_saturated reports heavy queued load, and on a removable disk such as a USB backup drive it stays at Display.
• Measured disk latency. Physical disk rows add counts of slow and stalled intervals (io_slow_10s_count_5m, io_stall_10s_count_5m, io_slow_window_count_1h) and io_pct_time_stuck. queue_depth_avg is now the average number of IOs in flight. The performance row names the busiest disk with its queue depth, latency, IOPS and throughput, and adds totals across all disks.
• Low disk space shows whether the volume is still filling. os_volume_space_low and data_volume_space_low climb as free space runs out, and one level higher while the volume keeps filling. The message adds "still filling; full in about N hours", and volume_filling marks the volume.
• Memory conditions match how Windows runs out of memory. ram_commit_near_limit compares commit to the most the page files can grow to, not to their current size. ram_pressure opens on low available memory with heavy paging. The performance row reports the page files, the time threads wait on paging, and the top 10 processes by private commit.
• Recurring kernel crashes name the crash. The kernel_crash_recurring message names the bug check most of the crashes share.
• Boots and shutdowns the agent did not see. The agent rebuilds shutdowns and boots that happened while it was stopped from Windows records. A Fast Startup shutdown is reported as a shutdown and a boot, and a jump in the device clock as host_clock_stepped.

Maintenance & Improvements:

• Service importance comes from the Data Feed Pack. Each service in the pack's table has a tier (suppress, ordinary, important, critical or critical_shared) that sets how fast its conditions climb and how high they go. A service can rank higher on a server, or on a host with a role such as domain controller or DNS server. A service the table does not list is ordinary: Display on a workstation, Notice on a server. The services topic reports each service's tier in service_tier.
• Retired conditions: os_volume_space_exhausting and data_volume_space_exhausting (now part of the low-space conditions), kernel_crash_signature_recurring (now part of kernel_crash_recurring), ram_commit_near_cap and ram_hard_fault_storm (replaced by the new memory conditions), audit_policy_reapplied, vss_shadowstorage_near_cap and volume_bitlocker_dropped. Their open episodes end after the upgrade, with the reason in sparklogs.episode.end_reason.
• volume_bitlocker_protection_dropped opens at Notice when BitLocker protection on a volume that had it stays off or suspended for 24 hours.
• Repeated crashes of an application the pack does not list stay at Display, and reach Notice at 10 crashes a day.
• patch_scan_stale opens after 24 observed hours without a Windows Update scan, and cpu_busy reaches Notice after 60 minutes.
• A failed VSS writer of an application opens at Display and reaches Warning if it is still failed 24 observed hours later.
• An unexpected shutdown is a Warning on a server.
• Service exit codes carry their Windows name, such as ERROR_PROCESS_ABORTED, and conditions name services by display name.
• The performance row reports the time zone offset, daylight saving time, and the number of active, unlocked and disconnected user sessions.
• Fewer duplicate records: each ended boot is reported once across agent restarts, and removed items no longer appear on condition rows.

Data Feed Pack 1.9.0 (2026-10-17) - Service Tiers, Storage and Memory Events

Pack 1.9.0 requires SparkLogs Agent 1.13.0.

Features:

• Service tiers. The service table gives each known service a tier, and some services a higher tier on servers, domain controllers or DNS servers. SQL Server, Exchange, Active Directory, Hyper-V and FSLogix rank highest on servers. Backup, endpoint security, RMM and remote access agents are important. Versioned self-updater services that stop by design no longer raise conditions.
• Storage errors know which disk they are on. Disk and storage driver events are matched to the disk inventory, so the same error rates lower on a card reader or USB disk than on a fixed disk. A storm of repeated storage errors ships one row per disk and error every five minutes, with the count of the rest. A degraded drive on a server is Serious, and a drive predicting its own failure is Error.
• Memory exhaustion events. Windows' low virtual memory diagnosis (Resource-Exhaustion-Detector 2004) and the "out of virtual memory" warning arrive as ram_commit_exhausted, with the commit, the commit limit and the program using the most memory. Page file growth arrives as pagefile_extended.
• Firewall rule changes name who made them. Rule changes from the Windows Firewall log arrive as configuration changes with the user, the program and the rule settings. Security 4946 to 4948 stay as audit records.
• Service hangs at Notice. A service that hangs while starting (System 7022) arrives as service_hung_starting, and service timeouts (7009 and 7011) are lowered to Notice.
• Account lockouts carry more precise severity. A lockout of the built-in Administrator account, under any name, is Warning, and other lockouts are Error. A failed SQL Server Agent job arrives as mssql_agent_job_failed at Error.

Maintenance & Improvements:

• Repeated RDP, NTLM and scheduled task records are rate-limited, and routine scheduled task upkeep and per-user service instances are marked.
• Time sync and DNS registration failures are Warning on servers and Info on workstations.
• BitLocker, Entra sign-in and Windows Firewall records have more specific reasons and severity.
• Device state references updated for SparkLogs Agent 1.13.0: service tiers, disk measurements, volume filling, memory, network and lifecycle fields, and the retired conditions.

SparkLogs AI Plugin 1.9.0 (2026-10-17) - References for Data Feed Pack 1.9.0

Features:

• Reference material for Data Feed Pack 1.9.0 and SparkLogs Agent 1.13.0. Feed, field and condition references cover service tiers, disk latency on the physical disk, volume filling, the memory conditions, network adapters and settings, the lifecycle topic and the new configuration change types.
• References for Data Feed Packs 1.8.1 to 1.8.4. Crash summaries, process classes, restart reasons, configuration changes, maintenance labels and audit policy changes are covered.

Maintenance & Improvements:

• The disk full or filling playbook and the category guide use the current volume space conditions.

Application v2026-10-16p - Fleet Health and Device Timelines

Features:

• Fleet Health. The new Fleet page lists every device, the ones that need attention first, with its worst open condition, number of open conditions, last telemetry and collection status. Filter by organization (for most MSPs, a client), servers or workstations, reason, and minimum severity. Optionally include the other sources your ingest keys sent logs from.
• A timeline for every device. Each device has a page showing its conditions, crashes, configuration changes, notable events, performance and telemetry over a window (7 days by default). Click or drag on the timeline to pick a moment, T, and the tabs below show the device as it was then. The URL keeps the range, T and selection, so a copied link opens the same view.
• See when a device was asleep, off or down. The timeline marks sleep, hibernation, Modern Standby, power off (including Fast Startup), unexpected shutdowns, crashes with their bugcheck, and stretches when the agent was not running. Agent restarts for updates are drawn lighter, and a stretch with no reports reads "No reported data".
• Performance on the timeline. CPU, RAM, commit and disk lanes show load as height and waiting work as color: grey is keeping up, red means threads waiting for a core, paging stalls or slow disk responses. Hover a lane for the readings and top processes at that time.
• Performance tab. CPU, memory, commit and per-disk charts with the top processes over time, and a Capacity card showing how much of the window each resource spent over its threshold, with the threshold named.
• Findings, worst first. Conditions and crashes in the window are listed by severity. Select one to move T to it and see why it is at its severity, what clears it, its threshold gauge, its episode history, and the changes before it began.
• Blast radius. A condition shows how many other devices in the same organization had it open in the window, so you can tell a one-off from a wider problem.
• Changes tab. Every software, driver, service, volume, system and security setting change, with old and new values, whether a Windows log recorded it or the agent observed it, and whether it is routine maintenance. Open one item to see its whole history.
• Crashes tab. Kernel and application crashes with their dump analysis (bugcheck, blamed module, stack frames, loaded modules), how often the same crash recurred, and the changes in the 24 hours before.
• Device state at T. Storage (a Disk Management style disk map with volumes and file systems), Processes, Services, Software, Drivers, Audit policy, and other reported topics, each with its as-of time and when each field last changed. Condition chips mark the disk, service or process a condition is on.
• Events over the window. Logs (the device's events with a histogram, a subsource picker and a Notable filter), PowerShell Activity (recorded scripts, grouped by content), Signals (event counts by reason, application, service and subsource per severity band, linking to Logs and Explore), and Collection (feed health history and agent and Data Feed Pack versions).
• Copy evidence for your AI assistant. One click copies a prompt with what to investigate, what the page shows at T, the exact IDs and times to query, a system summary, and a link back to the page.
• Move between Explore, Agents and devices. Open a device from Configure > Agents, or from an event in Explore at that event's time. Links from the device page open Explore on the same time range and device.

Maintenance & Improvements:

• Alt + scroll (Option + scroll on a Mac) zooms the timeline and device charts; on a trackpad, pinch.
• Explore and the device page share one time zone setting.
• Links into Explore carry their UTC offset, so they open at the same moment in any time zone.
• A new Explore search scrolls back to its focused event.
• Fixed a font change when hovering an Explore row.

Cloud Services v2026-10-16 - Device Timelines and Fleet Performance Queries

Features:

• Find the busiest processes across a fleet. query_device_health adds view=fleet_processes, the process images using the most CPU, RAM, reads or writes across every device in scope, and view=fleet_performance, how one reading (CPU busy, run queue, commit, paging stall) spreads across devices. group_by=device lists the outlier devices to look at next, and image narrows to one executable such as chrome.exe.
• Know why a condition is at its severity. Condition rows carry threshold_status: why the condition sits at its severity, what clears it, and when time alone reaches the next level if nothing resets it. threshold_status_brief gives the same in under 100 characters.
• Thresholds count awake-time. Time-based thresholds count only while the device was on, awake and watched by the SparkLogs Agent. Sleep, shutdown and agent restarts pause the clock, so a laptop asleep over a weekend does not escalate.
• Crashes appear in default device health listings. Process crashes and other one-time occurrences are included by default, the latest per reason and device; view=event_timeline lists every one.
• A device's configuration history in one call. kinds=["config_change"] with view=event_timeline returns every recorded or observed change in the window, for one or several devices. sparklogs.config_change.basis says whether a Windows log recorded the change or the agent saw the setting move, and category=maintenance marks routine upkeep.
• Reasons per pattern. describe_pattern lists up to five reason codes per pattern, and group_by_reason=true returns exact statistics and example messages for each reason.
• How each source was collected. Events record their collection origin in collector_source_kind (agent or ingest_key), set from the credential that sent them, so data sent with an ingest key cannot pass as agent data. list_sources returns one row per origin.
• HTTP request fields from any log line. A quoted request line such as "GET /api/users HTTP/1.1" becomes method, URL and protocol fields wherever it appears, including application logs. HAProxy HTTP logs are recognized and their status, byte count, client and request are extracted.

Maintenance & Improvements:

• A number that BigQuery cannot store exactly (too large, too precise, or with an extreme exponent) no longer fails the whole ingest request or gets rounded: it is stored as its original text. Every occurrence of a key repeated in one JSON object is checked, not only the first.
• Clock correction for devices with a wrong clock now also applies to the time Windows recorded an event and to inventory reading times.
• A device health query whose window ends before the time of the call is treated as history: no row reads as current and no threshold time is projected from it.
• Every result page reports the exact number of matching rows, including pages past the end.
• Percentiles on BigQuery are computed as approximate sketches and are labeled as estimates.
• Agent IDs in device filters match regardless of letter case.
• Transient BigQuery errors are retried automatically instead of failing the query.
• Query API responses are compressed (zstd or gzip), so large results download faster.

Data Feed Pack 1.8.5 (2026-10-07) - Less Duplicate Data and Collector Noise

Pack 1.8.5 requires SparkLogs Agent 1.12.4.

Maintenance & Improvements:

• Lower ingestion volume. PowerShell and summarized logs carry less duplicate information while retaining event text and investigation details.
• Less collector noise on heavily audited devices. Successful file-access records from the SparkLogs Agent and its collector running as SYSTEM are excluded from collection. These records remain in the device's Windows Security log.

SparkLogs Agent 1.12.4 (2026-10-06) - Understand What Changed on a Device

Features:

• Investigate what changed before a problem began. Changes to services, installed software, drivers, Windows, security settings and device roles identify the affected item and its previous and new values.
• Distinguish maintenance from other changes. Recognized routine updates are labeled as maintenance, helping you focus an investigation while keeping upkeep visible.
• Follow a service's configuration history. Track installation, removal, startup settings, command lines and logon accounts for the same service. Where Windows provides matching installation evidence, the change links to the original record and time.
• Follow software and driver updates. See additions, removals and version changes, including driver updates that Windows assigns a new package name.
• Track changes to device security and roles. Changes to Secure Boot, TPM, Windows and detected roles help explain shifts in a device's behavior or protection.

Maintenance & Improvements:

• Temporary per-user Windows services remain in device inventories without generating configuration-change noise or service-health alerts.

Data Feed Pack 1.8.4 (2026-10-06) - Better Context for Configuration Changes

Pack 1.8.4 requires SparkLogs Agent 1.12.4.

Features:

• Connect Windows installation records to the affected service. Service installation events identify the service when Windows supplies its name, helping you trace its history alongside the agent's observations.
• Recognize routine updater activity. Supported installations of versioned updater services are labeled as maintenance.
• Understand changes to audit coverage. Audit-policy changes identify the affected policy, with severity reflecting reductions in recorded security activity.

SparkLogs Agent 1.12.3 (2026-10-04) - Device Timeline, Change Counts, Exact Repeat Counts

Features:

• The agent reports its own start and stop. Each start and stop arrives as a sparklogs_agent_started or sparklogs_agent_stopped occurrence with sparklogs.reported_by=agent, and a stop names its cause: update, os_shutdown, operator or error. With Data Feed Pack 1.8.3, Windows' own record of the same start and stop arrives with reported_by=os, so a gap in a device's data can be told apart from an agent that was stopped.
• Routine change counts. Installed products, drivers and services carry sparklogs.change_counts.added, removed and changed on inventories and change events, counting rows that appeared, disappeared or moved a routine field (a product or driver version; a service's start type, command line or account). An inventory marks the rows that moved and lists the instances that were removed, so you can see what changed without diffing two inventories.
• Services report their command line and account. The services topic adds command_line (the service's executable path with arguments) and account (the account the service runs as), and changes to either are tracked.
• Configuration changes the agent observes share one shape. A setting the agent saw move arrives as a config change event with sparklogs.config_change.basis=observed, the list of fields with their old and new values, and the same type and target names as the matching Windows log record where one exists (audit policy, for example), so the two line up in one query.
• Audit policy re-applied with no net change. When Windows rewrites the audit policy 30 or more times in an hour and the policy does not change, the audit_policy_reapplied condition is raised at Notice. Repeated re-application shows up as one condition instead of a flood of change records.
• Exact repeat counts. A burst of identical events inside one read now ships one row and counts the rest. Before, a burst that arrived in a single batch could pass whole, so rate-limited events such as sensitive privilege use were undercounted as suppressed and overcounted as shipped.

Maintenance & Improvements:

• Inventories and change events carry sparklogs.epoch.t, sparklogs.epoch.prev_t, sparklogs.cadence_s and, when both readings fall in the same boot, sparklogs.elapsed_s (time between readings, including sleep), so a timeline can measure the time between readings against the interval that scheduled them.
• After an agent upgrade, the first start checks for a newer Data Feed Pack before collection begins, so a device moves to the pack that matches its agent without waiting for the next update check.

Data Feed Pack 1.8.3 (2026-10-04) - Device Timeline, Restart Reasons, Quieter Security Feed

Pack 1.8.3 requires SparkLogs Agent 1.12.3. On each release ring the pack is published before the agent: a device on an older agent does not download pack 1.8.3 and keeps the pack it has, and a device that upgrades to agent 1.12.3 checks for pack 1.8.3 before it starts collecting. If a release ever has to be rolled back on a ring, the pack is rolled back first, then the agent.

Features:

• Boot, shutdown, sleep and wake on the device timeline. os_boot, os_shutdown, os_sleep and os_wake ship as occurrences, so a device's power history lines up with its crashes and conditions.
• Who restarted the device, and why. A restart or shutdown request (os_restart_requested) names the program that asked on sparklogs.process, the user on sparklogs.actor, and the reason, reason code, shutdown type (restart, power_off, shutdown or other) and comment.
• Unexpected shutdowns are timed when the device stopped. An unexpected_shutdown occurrence carries the time the device went down, read from the event itself; the time Windows wrote the record after the next boot stays in recorded_at. Kernel-Power 41 still ships with its bug check.
• Agent start and stop as Windows saw them. Service Control Manager start, stop and crash records for the SparkLogs Agent's own service ship as sparklogs_agent_started and sparklogs_agent_stopped with sparklogs.reported_by=os, beside the agent's own report.
• Every configuration change says how it is known. sparklogs.config_change.basis is recorded when a Windows log recorded the change and observed when the agent saw the setting move. Audit policy changes (Security 4719) target the device's system audit policy with the subcategory in its own field, and service installs (System 7045, Security 4697) ride the services topic.

Maintenance & Improvements:

• Every rate limit and the PowerShell repeat-run record use the exact repeat count from SparkLogs Agent 1.12.3.
• Sensitive privilege use (Security 4673 and 4674) is rate-limited over 5 minutes instead of 1, and object deletion (Security 4660) is rate-limited per user and program over 5 minutes, each with the number of records held back.
• Device state field references updated for SparkLogs Agent 1.12.3: change counts, the services command_line and account fields, epoch timing, and observed config changes.

SparkLogs Agent 1.12.2 (2026-10-04) - Update Reliability, Disk IO on Virtual Machines

Features:

• Disk and volume IO rates from Windows performance data. Read and write rates for disks and volumes now come from the same Windows performance data the agent already reads for CPU and memory, so they are reported on virtual machines (including Hyper-V guests) where the previous source returned nothing.

Maintenance & Improvements:

• Automatic updates are more reliable on devices with more than one agent instance: each update unpacks under the instance's own data folder, co-installed instances check for updates a few seconds apart, and an update that finds another installer running waits and tries again instead of failing.
• A failed update reports the installer's exit code, even after the agent restarts on its previous version, and every update status change is reported right away.
• Agent heartbeats are smaller and change less often: detector status no longer includes the live list of running processes.

Data Feed Pack 1.8.2 (2026-10-04) - Service Crashes as Occurrences

Features:

• Windows service crashes are occurrences. Service Control Manager 7031 and 7034 (service_crashed) ship as occurrences, so they appear in device health beside kernel and application crashes. With SparkLogs Agent 1.12.2 or later they name the crashed service as sparklogs.instance (service:<key name>), the same subject the services topic uses.

Maintenance & Improvements:

• Security 4649 is renamed from replay_attack_detected to kerberos_duplicate_request_rejected and lowered from Error to Warning. The event is a rejected duplicate Kerberos request, most often a duplicated packet or a retrying client, and does not by itself show an attack.

SparkLogs Agent 1.12.1 (2026-10-02) - Crash Summaries, Audit Policy, Lower PowerShell Volume

Features:

• Crash summaries per application and per kernel crash signature. Every 8 hours the agent reports which applications crashed in the last 1, 5 and 10 days and which kernel crash signatures keep coming back, with the module to blame and, for .NET applications, the exception that ended the process. An application that keeps crashing becomes a condition on that application, so one noisy app no longer hides behind a generic "this device crashes" signal.
• Crash severity depends on what crashed. An unknown application that keeps crashing is a Warning. Known backup, security and other business software can reach Error. Core server roles (SQL Server and other databases, domain controllers and DNS, Hyper-V, and the main RMM engines) can reach Serious.
• Audit policy inventory. The agent reports which Windows audit categories each device records, every day, and raises a change event when the policy changes. You can now see which devices would not record a failed logon or an account change, and when a device's audit policy was weakened.
• Configuration changes are their own event type. Changes to tracked settings arrive as a distinct config change event naming what changed, from and to, so they are easy to query apart from health readings.
• Much less PowerShell data. Repeated PowerShell scripts are now recognized reliably, so each script's text ships once and later runs arrive as a short count. Line-by-line module logging and routine engine start and stop messages are no longer collected by default; errors and commands on the watch list still ship in full. On the fleets we measured, PowerShell was about half of all ingested data and we expect most of that to go away, cutting total ingest by close to half.

Maintenance & Improvements:

• Feed health now says whether Security event suppression is active on a device and how fast the collector is reading each Windows Event Log feed.
• Event text no longer loses a space or line break where Windows splits a long event (such as a large PowerShell script) into pieces.
• Event Log lag is now exact on every channel, including channels whose log was cleared.
• The installer no longer re-opens the agent's files between proving them free and replacing them, which removed a rare "restart required" result on hosts with aggressive on-access scanning.
• Fixed a disk volume reading that flipped between stale and fresh every five minutes on many servers, most often virtual machines. A volume is now marked stale only when its last scheduled probe failed, and a disk whose volumes do not report IO counters no longer blocks its own IO measurements.

Data Feed Pack 1.8.1 (2026-10-02) - Crash Summaries, Process Classes, PowerShell Curation

Features:

• Process classes. Known processes are classified (backup, security, RMM, databases, directory services, virtualization, VPN, remote access, web servers, printing). Classification determines severity curation for process crashes.
• .NET crashes are identified. .NET crash exception codes are decoded.
• New crash and audit reasons. app_crash_recurring (an application keeps crashing), kernel_crash_signature_recurring (the same kernel crash keeps recurring) and audit_policy_changed.
• PowerShell curation. Routine engine start and stop messages and line-by-line module logging are dropped, recurring host and error messages are rate-limited, and repeat-run records are smaller.

Maintenance & Improvements:

• Device state field references updated for SparkLogs Agent 1.12.1: the app_crashes, kernel_crashes and audit_policy topics, config change events, and the new feed health and pipeline fields.

SparkLogs Agent 1.12.0 (2026-09-30) - Crash Reports, Security Event Suppression, Rollout Waves

Features:

• Kernel and application crashes become device conditions. Crashes are detected and records and dumps for one crash are consolidated into one occurrence. Recurring kernel crashes are flagged. Bugcheck and exception codes are decoded.
• Bounded local dump analysis. A supported kernel or user-mode dump is analyzed on the device in an isolated worker: faulting module and offset, loaded modules, process identity and stack frames. Work is bounded (one worker, 60 seconds per crash, daily quotas) and partial results ship with an explicit status. WHEA hardware error records and nearby Modern Standby transitions are decoded as context.
• Faster dropped events. A Data Feed Pack can name event ids that are always dropped, and Windows filters them directly before we process them. This reduces CPU usage dramatically for systems with extremely busy security audit logs.
• Controlled rollout waves. There is no more precise control over staggered agent rollouts. You can also customize "how late" in a rollout wave when you want to receive updates, if you prefer to receive updates towards the end of a release wave.

Maintenance & Improvements:

• Feed health on a suppressing channel reports its lag as an upper bound (lag_is_upper_bound); behind or stuck rows carry the collector's read rate (records_read_per_min).

Data Feed Pack 1.8.0 (2026-09-30) - Crash Topic, Security Suppression, Quieter Network Feed

Features:

• Crash reports. A crashes device-state topic with kernel_crash, kernel_crash_recurring and process_crash conditions, generated references and example reports; WHEA-Logger boot error records are decoded on the system feed.
• Quieter network feed. SMB Server 1040, 1033 and 1034 (benign arm narrowed to 1038) and Local Session Manager 59 are dropped as noise; a 15-minute repeat stage rates SMB Client 30800 per server, Windows Filtering Platform 1030 per host, Remote Desktop client 1033 per component and Firewall 2083 per setting and user.

Maintenance & Improvements:

• Device state field references updated for SparkLogs Agent 1.12.0: lag_is_upper_bound, records_read_per_min and the crashes topic fields.

SparkLogs AI Plugin 1.8.0 (2026-09-30) - Crash and Feed Health References

Features:

• Reference material for Data Feed Pack 1.8.0. The crashes topic with kernel_crash, kernel_crash_recurring and process_crash, decoded WHEA hardware error records, and the network feed changes are covered.
• Event log filter status. References cover log_collection_query_filter_not_applied and log_collection_query_filter_rejected, raised when the collector cannot filter out the events the pack drops, and the feed health fields lag_is_upper_bound and records_read_per_min.

SparkLogs Agent 1.11.9 (2026-09-29) - Event Log Feed Health Detail

Features:

• Windows Event Log feed health shows why a feed is behind. A behind or stuck feed health row emits polls_at_head and polls_on_budget. This can be used to determine whether the machine is slow or a channel is moving too fast.

Maintenance & Improvements:

• Event log reads are more accurate. A channel is marked caught up as soon as its drained, without waiting for an idle cycle. On very busy channels this ensures the channel can still be marked as fully drained.
• Storage and performance data now use one read lifecycle: the same retry schedule, device tracking and pairing checks apply to every stateful Windows read, so a stuck or missing signal reader recovers the same way everywhere.
• A system signal read that is still failing after its retry ladder is retried once per day.

SparkLogs Agent 1.11.8 (2026-09-28) - Memory Optimizations

Features:

• Lower memory on every device. The agent uses less memory to store device health state and history and also bounds its on-disk state cache.
• Less memory required to read performance counters. Less memory is used to read the Windows system performance readings (run queue, hard faults, interrupt and DPC time, processor clock, memory list sizes).

Maintenance & Improvements:

• A change in a virtual machine's total memory (dynamic memory) no longer produces a "system identity" change event. A system information change that does not touch an identity field now names the fields that moved.
• The Windows Update last-scan check no longer waits on a hung Windows Update service; a slow or hung service keeps the previous reading and is retried on a bounded schedule.
• A bounded, budgeted mechanism is used for any external signal or API call that might block; any signal provider that is slow or blocked does not block other providers.

Data Feed Pack 1.7.1 - 1.7.4 (2026-09-28) - Quieter Storage Feed

Features:

• Empty card readers and printer slots no longer report as errors. A device that answers "no media" to a probe is at rest, not failing. Storage class driver events 500, 502, 504, 505, 506 and 523 with that status are dropped, whatever the device model; any other status, and every disk removal, retry and predicted failure, still ships.
• Capability probes that a disk cannot answer are dropped. Windows asks every disk whether it has an ATA SMART surface, a cache page, or trim support. RAID virtual drives, hypervisor virtual disks and USB bridges answer "I/O device error" or "not supported" to every poll; those answers (event 504 with the SMART, cache information and data set attributes control codes) are dropped. A failed read or write on the same device still ships.
• Commands that never ran are dropped. Storage class driver event 507 is dropped when the port driver reports the command was rejected as not implemented, busy, or flushed with no sense data: the answer of removable media to synchronize cache, start stop unit and test unit ready polls. A command that ran and failed, timed out, or hit a bus reset keeps its row as a device command failure.
• Enhanced storage power transitions are dropped. The entered and exited power state events (104 and 105) that a USB device emits as Windows suspends and resumes it are dropped at Information level. Arrival, removal and surprise removal still ship.

Maintenance & Improvements:

• Device state field references updated for SparkLogs Agent 1.11.9: Windows Event Log feed health rows that are behind or stuck carry polls_at_head and polls_on_budget.

SparkLogs AI Plugin 1.7.4 (2026-09-28) - Feed Health References

Maintenance & Improvements:

• Feed health references for SparkLogs Agent 1.11.9: a Windows Event Log feed that is behind or stuck reports polls_at_head and polls_on_budget.

Cloud Services v2026-09-26 - Process Trends and Inventory Queries

Features:

• Top-process trends in one query. Rank processes by CPU, resident memory, reads or writes, grouped by executable name or individual process. Results account for measured collection duration, distinguish resident and private memory, and show remaining process activity and collection gaps. Partial time buckets are flagged.
• Discover and chart device measurements. The new topic listing shows available measurements and observed fields, with query examples. The series view returns raw inventory samples for charts and further analysis.
• Large inventories retain every part. Latest-state queries keep all reported parts of the selected inventory, including large process and installed-software lists. Observation times and part numbers help assistants check freshness and completeness.
• Larger result pages. Eligible tools accept explicit limits up to 100,000 rows, subject to response-size limits. Result metadata identifies returned rows, ordering and continuation.

Maintenance & Improvements:

• Shorter tool descriptions fit more AI clients. Assistants can retrieve full instructions and detailed tool guidance through server_info.
• JSONL topic listings return field lists and query examples as structured values.
• Fixed query failures affecting some filters with multiple OR conditions.
• Corrected clock adjustment for device-reported inventory absence timestamps.

SparkLogs AI Plugin 1.7.0 (2026-09-26) - Pack 1.7.0 References, Device State Guidance

Features:

• Reference material for Data Feed Pack 1.7.0. Feed, field and condition references are regenerated for the pack, including the renamed conditions, the shared status code fields, and the device state fields for SparkLogs Agent 1.11.5. Topic pages include collection frequency.
• Three ways to read device health. The device state guide explains when to ask for current conditions per device, the latest state of each subject (a disk, a service, a process), or a time series for charting, and how to chart the top processes on a machine correctly.
• Query guidance follows the investigation. Device questions use query_device_health; general table queries use the table listing and query tools. Guidance covers scope selection and pairing problem queries with recovery queries to establish whether a fault cleared.

Maintenance & Improvements:

• Playbooks, themes and skills updated for the renamed conditions: BitLocker recovery, disk full or filling, slow logon, device health, Windows updates, and the ask, investigate and analyze-cause skills.
• Generated field definitions clarified so the meaning of each field is stated once, in the same words the reference site uses.

SparkLogs Agent 1.11.7 (2026-09-26) - Upgrade-Safe Fields, Feed Health Follow-Ups

Features:

• Adding a field never reads as a change. Each device state topic now records which fields its stored state was built with. When a release adds a new state field, the first reading after the upgrade is recorded as a first measurement, not as a change on every row, so an agent upgrade produces no fleet-wide change events.
• Change events carry more context. Driver rows include the friendly name, INF file and class; process rows include resident and private memory; service crash and VSS snapshot-failure rows include when the failures were first and last seen. A service's classification (which comes from the data feed pack, not the host) no longer produces change events when the pack updates it.

Maintenance & Improvements:

• Feed health no longer shows a stale reason beside a healthy feed: a feed that is current carries no reason, and the previous-state body of a later change shows only what was last reported. A feed that is still blocked after an agent restart is not re-announced.
• Feed health treats a small, steadily moving unread tail as progress rather than reporting the feed as behind; a real backlog that is catching up after an outage still reads as behind until it clears.
• The blocked reason and its error kind always change together on a feed health row.
• Process handle counts and the memory commit percentage are treated as readings and no longer appear on change rows.

SparkLogs Agent 1.11.6 (2026-09-26) - Quieter Restarts, Faster Change Delivery

Features:

• A single change on a quiet server is delivered promptly. Service and process changes are batched briefly (60 seconds for services, 5 minutes for processes) so a burst reads as one event. A lone change is now delivered as soon as its batch window closes, instead of waiting for the next scheduled inventory, which could be hours.
• Removals respect their grace period. A disk, volume, VSS writer or service that disappears briefly (a USB drive re-enumerating, a service restarting) stays listed until its grace period expires. If it returns in time, nothing is reported; if it does not, one removal event ships carrying absent_since, the moment it was first seen missing.
• Change events carry their measured readings. A changed service, volume or crash-dump configuration row now includes its rolling readings (crash counts, fill rate and time-to-full estimates, CPU and IO averages) alongside the changed fields, so the event stands on its own.
• Feed health says why a file could not be read. A feed blocked on a file it cannot read reports error_kind (permission_denied, sharing_violation or other) and the Windows error code, and access_denied is reserved for a genuine permission fault.

Maintenance & Improvements:

• An agent restart or upgrade no longer reports the device state feed as blocked for several minutes. Feed health also requires a fault to persist across two consecutive checks before reporting it, and a feed's since timestamp survives agent restarts.
• Upgrading from an agent before 1.11.5 logs one line rather than an "unclean stop" message for every topic.
• A collector that stalls on its first run after being overdue is reported as stalled rather than stale.
• Reduced disk reads: the periodic pack update check no longer re-reads the whole data feed pack; integrity is still re-verified on a fixed cadence.
• The agent's own restart timing can no longer produce change events: every topic is exercised through fresh installs, restarts at every phase, reboots, crashes, warm-up and measurement gaps in the release tests, with zero tolerated.

Data Feed Pack 1.7.0 (2026-09-25) - Consistent Condition Names

Features:

• Unify naming scheme for conditions. Condition names across all feeds and device state topics were reviewed together and made consistent: the subject comes first, the fault is stated as a fact rather than a consequence, abbreviations are spelled out, and severity words are kept out of the name. Related conditions that named the same fault are merged, and conditions that mixed two faults are split. Collection health conditions are now log_collection_* and log_delivery_*, and the agent's own resource conditions are sparklogs_agent_*_over_budget. See Reasons for the full list.
• Status codes live in one place. Windows status words that were stored under feed-specific field names (NTSTATUS on system events, app package status, HTTP result codes, MSI status) now resolve to the shared sparklogs.result fields. Process and destination host names also moved to their shared fields.
• Application crash reports carry the application and service. A crash report names the crashing application and, where Windows recorded one, the service it ran as, so two crashes of different applications are two items and the same application twice is one item with a count.
• Component store corruption reads as one condition. Setup scan results that found corruption join the existing component store corruption condition instead of reporting separately.
• Every documented condition is backed by an observed sample. 148 conditions now cite a real event sample; conditions without one are marked so on their reference page.

Maintenance & Improvements:

• Saved queries, alert rules and dashboards that filter on a renamed condition need the new name.
• A Windows Defender scan that stops is Warning only when the scan was aborted; a scan interrupted by sleep or a reboot, or a stop with no recorded reason, is Info.
• Office dialog alerts and legacy Volume Shadow Copy driver scans no longer ship as conditions; the events still ship as searchable data.
• Routine high-volume shapes carry a per-host cap, so a chatty machine cannot crowd out its own faults.
• Device state field references updated for SparkLogs Agent 1.11.5: agent resource usage fields report bytes under shorter, consistent names; top_processes states the seconds it measured over; the performance topic carries CPU peaks.
• A duplicate MSI status field on installer events is removed. Reserved names for cluster node and collector conditions renamed for consistency.

SparkLogs Agent 1.10.0 - 1.11.5 (2026-09-25) - Device Health Monitoring

Features:

• Device health is scored. The agent watches disks, volumes, services, processes, memory, CPU, VSS, Windows Update and its own health, and raises a named condition when a state holds long enough to matter (a volume filling, an automatic service that stays down, a stuck service start, a shadow copy store near its cap). Each condition opens, escalates, recovers and closes as one episode, so a two-hour outage reads as one item with a start and an end. See Health topics.
• Device state message lines say what changed. Inventory and change events carry a meaning-rich one-line summary: 2 automatic; 1 running, 1 expected stopped. or 2 changed, 1 started, 1 exited; "+svchost.exe" "-backup.exe". Inventory data rows are ordered by what matters first (the fullest volume, the longest-stopped service, the heaviest process).
• New health topics. Storage devices and the volume-to-disk map, drivers, installed products with change signals, Windows Update state, feed health and collector health.
• Recognized workloads. The agent automatically identifies and records workloads (SQL Server, domain controller, DNS server, Hyper-V), customizing monitoring thresholds to ensure prompt response for key workloads.
• Pack pipelines. Data feed packs can now merge multi-part events, collapse repeats into a receipt with a count, and route events before shaping. Data Feed Pack 1.6.0 uses this for PowerShell script blocks.

Maintenance & Improvements:

• Only ordinary disks are measured. Optical, network and removable-media volumes keep an inventory row carrying their drive type and are never space-probed or graded.
• Agent memory usage is reduced and Windows event log subscriptions are faster and lower overhead.
• The agent is faster and more efficient in monitoring service health.
• Feed health properly considers disabled channel states. A collector outage shorter than the feed's tolerance leaves the verdict to the feed's other channels. Feed status now includes failure details at the individual channel level.
• Logging for temporary transport issues or event log subscription issues are less noisy.
• A device that is still onboarding no longer flips between onboarding states across heartbeats.
• Requires Data Feed Pack 1.6.0 or later for the PowerShell feed; older packs continue to work.

Data Feed Pack 1.6.0 - 1.6.3 (2026-09-24) - PowerShell Script Blocks, Config Changes, Storage Decodes

Requires SparkLogs Agent 1.11.2 or later.

Features:

• PowerShell script blocks arrive whole, once. Multi-part 4104 records are merged into one event per script, and a script seen again within 14 days on the same host ships as a short receipt with a count instead of the full text. The first copy carries the full script up to 256 KB. The message line names what the block does: destructive script block by "CORP\jsmith" pid 4412; ... calls "Remove-Item" ...; targets path_written "C:\ProgramData\stage\p.bin". Framework code Windows compiles on its own behalf is recognized and shipped without a body. See PowerShell feed.
• Configuration changes have one shape. Every change row states the kind of object that changed (a Windows service, a group, an audit subcategory, a scheduled task, ...), the action, and the object's identity, so two installs of different services are two rows and the same service twice is one row with a count. Security principals acted on are named separately and only when the event carried one.
• Storage decodes reach Storport and StorDiag. A StorDiag 504 event decodes its IOCTL control code and its NTSTATUS to readable names. Storport entries that carry expected sense data, a drive reporting a routine condition, no longer ship.
• Default-disabled channels are marked. Channels that Windows registers but ships switched off are marked in the pack, so the agent leaves them unbound and a feed's health does not wait on them.
• Workloads replace "systems". SQL Server, domain controller, DNS server and Hyper-V pages describe what a client runs and how it is recognized. See Workloads.
• Field reference for every topic and feed. Each device state topic page and feed page carries a field table: name, type, unit, what the field means, an example, and the agent version it first shipped in.
• Device state event examples. Device state condition and inventory pages document the message and fields in each kind of event. Reason pages document curated fault conditions: what they mean, what to do, and relevant Microsoft references.
• Known Windows services are classified. 73 built-in services (Print Spooler, Windows Update, DNS Client, Task Scheduler, Remote Desktop, ...) are associated with a diagnostic theme, making it easier to correlate events.

Maintenance & Improvements:

• Scheduled task registration events are kept. Only Group Policy's own registrations (event 140 raised by NETWORK SERVICE under Microsoft\Windows\GroupPolicy) are dropped.
• Quieter collector self-reporting: Event Log resume-ladder lines for a dead bookmark drop to debug, and the collector's own housekeeping lines no longer ship.
• A feed can declare how long one of its channels may sit unavailable before the feed reports itself blocked. Shipped feeds use the agent defaults: 5 minutes for a required channel, 4 hours for an optional one.
• The declared ingest flush interval is 60 seconds, matching the agent default.
• Public pages say "reason code", "Workloads", "live" and "planned"; a feed is either collected and curated or collected and searchable.
• The device state feed is sparklogs.device.state (was sparklogs.agent.state); filter on subsource with the new id. Rows stored under the old id stay as history.
• Reference index rewritten as a concept page with an index per category.

Cloud Services v2026-09-22 - Table Queries and App Analytics

Features:

• MCP tools to list and query tables. This describes all available data sources (log and IT Fleet Intelligence data, App Analytics data), and provides a tool to query it. See Connect your AI.
• Filter data over any field. You can filter over any field in the schema, and for calculated tables with underlying tables, you can additionally filter the underlying data before the calculation is made.
• Time bucketing and aggregations. Group by a column or a time bucket, rank the groups, and aggregate with count, distinct, sum, average, min, max, and percentiles, including a filter on one aggregate so the same query can put totals next to errors, then keep only groups that meet a threshold.
• Calculated metrics. We also expose calculated metrics over base tables. For example, for App Analytics, 25+ metrics (DAU vs MAU, user retention, etc.) are provided. Results are cached and can be refined.
• Query for fleet-wide agent collection status. Allows you to check if data collection itself is fresh and healthy, which data feeds are stuck, and what to do about it.
• Explore App Analytics data with AI. With App Analytics enabled, ask daily active players, sessions, playtime, purchases, ads, and retention.

Maintenance & Improvements:

• The refine scope MCP tool was updated to search more broadly (better matching) and have a return shape that is easier to understand and use with other MCP tool calls. This results in a more precise scope, which leads to faster and more accurate query answers.

Application v2026-09-22s - Better Data Feed and Agent Status

Features:

• Data feed health displays channel-level detail. On a SparkLogs Agent that is not current, the data feeds section lists the individual Windows channels that are unhealthy and the Win32 errors causing the problem.

Maintenance & Improvements:

• A server that is health but offline is not marked as needing attention. Configure > Agents and the home dashboard no longer count a server that is offline but otherwise health as needing attention. It remains in the offline count and filter.

Cloud Services v2026-09-18 - MCP Across Device Health, Logs, and Analytics

Features:

• Three device-health views and better filtering. The default (omit view) is one row per episode: that episode's latest event. view=latest_state is one row per subject on the box (disk, service, process, software) containing just its latest state. view=event_timeline is every matching event in the window, oldest first. A severity floor on the default and latest_state views applies to that latest event. On event_timeline it applies to the peak in the window, then every in-window event of those episodes is included. This allows you to see all events connected to episodes that peaked above a given severity. See Health topics.
• Expanded query refinement. Fleet listings, the field catalog, pattern stats, and device-health pages come back as a query ID that you can refine: page, filter, and aggregate. Improves token efficiency and allows agents to incrementally explore data.
• Rank items inside device state inventories. Services, processes, volumes, and similar lists can be grouped and ranked by an item in the list (a stopped automatic service, a filling volume) across the fleet. See Lightning Query Language.

Maintenance & Improvements:

• Device-health severity filters are now strings and accept the same names as LQL (warning, error, and the rest of the LQL severity vocabulary).

Cloud Services v2026-09-17 - Precise Field Catalog Counts

Features:

• Precise counts of custom fields. The field catalog (Explore UX and MCP list_fields tool) now reports how many events in the window included each custom field precisely. Previously, this information was estimated at the ingest-batch granularity.

Data Feed Pack 1.5.0 - 1.5.5 (2026-09-12) - Six Windows Event Feeds Curated

Features:

• Six Windows Event Log feeds move from collected to curated: storage, identity and security, management, apps, platform and network. 120 named conditions, each with a class, a tuned severity, what it means and what to do. Routine narration on these channels is capped low or dropped, so the data prioritizes faults, not Windows housekeeping.
• Storage conditions: Bad blocks are Serious on a fixed disk (SATA, SAS, NVMe, RAID) and Warning on removable media; a controller reset is Error only on the boot device; NVMe self-reported failure predictions ship as a condition. SCSI sense key, additional sense code and SRB status decode to readable names. Command failures on empty card readers and DVD drives are dropped.
• Identity and security conditions: Code Integrity block events requested signing level, BitLocker recovery key escrow failures (Error) and device encryption failures, Windows Hello provisioning, Group Policy processing and domain controller discovery, AppLocker audit hits, LAPS password backup, Microsoft Entra registration and token failures, and directional NTLM use.
• Management conditions. Scheduled task start, logon and load failures with the result code decoded; DFS Replication stopped (Serious) and SYSVOL initial sync pending; Hyper-V VM start, checkpoint and replication failures and corrupted VHD chains; printer driver install failures; MDM policy failures naming the CSP; Windows Update download and scan failures.
• Apps, platform and network conditions. Packaged-app deployment, provisioning and activation failures; Dell tamper indicators and firmware verification scans; slow boot and shutdown; devices that fail to start; SMB client and server failures with the status decoded, insecure guest and signing posture, DHCP lease failures and address conflicts, DNS resolution timeouts, wireless connect and handshake failures, Offline Files sync.
• Normalized storage of Windows status codes. A status word on any curated event resolves to sparklogs.result.code, code_space and code_name (NTSTATUS, HRESULT, Win32, SSPI, CryptoAPI, LDAP and Entra token broker spaces), so one LQL filter matches a failure code consistently.
• Improved message formatting. A Windows event whose provider is not registered now renders as message text naming the provider, event id and channel, so patterns group properly; other event fields are still preserved in the payload.
• Conditions link across feeds. A fault reported by two feeds (a bad block seen by System and by Storage) links to its sibling on the reference pages. 17 network conditions carry "what to do" lines and references sourced to Microsoft documentation.

Maintenance & Improvements:

• Reduced noise from events: per-load Code Integrity traces, BITS transfer lifecycle, SMB transport selection, Server Manager refresh, WMI query narration, scheduled task run history and Volume Shadow Copy teardown no longer ship. NTFS and StorPort hourly latency summaries ship only when a slow-IO counter is non-zero.
• Known-benign Windows warnings stop reading as errors: peer-helper initialization on servers, ETW session name collisions, packaged apps refusing to run as the built-in Administrator, redirected printer configuration, device metadata lookups, Windows Update service-start status checks.
• Microsoft account and Entra token traces keep resource, timing and status and drop any token material.

Cloud Services v2026-09-08 - MCP Query Enhancements, Feedback Feature

Features:

• Send feedback using MCP. Securely send a note to SparkLogs support in your AI session, letting us know what needs to be improved, or with bug reports or product ideas.
• AI sessions get more done in fewer steps. We rebuilt MCP tool responses to focus attention properly and reduce agent confusion (especially weaker models). The higher-level query tools can now surface IT issues earlier and with fewer tokens.
• Ask about the fleet as a whole. Group and rank any events by any field or combination of fields (source and application, reason and device). Bucket trends by time or other dimensions.
• Configuration changes. Ask what changed on one machine or your whole fleet and get aggregate and individual details: what object was touched, what was done, who did it, and when. For example: service installs, group membership changes, audit policy changes and scheduled task creation.
• Refine enhancements. The refine tool has now capabilities to group, filter, and aggregate previously cached queries. This allows the initial query to return a smaller, more focused, token-efficient response, while allowing quick, precise follow-ups by AI agents.
• Aggregate math over device measurements. Average, minimum, maximum, standard deviation and exact percentiles over any numeric reading the agent reports, per device, across the fleet. Ask "which machines run hottest CPU at the 90th percentile this week" and get a ranked answer.
• Search inside inventories. Device inventories arrive as lists (every service on a machine, every process, every volume). AI agents can now filter matching items out of the list as part of the query, such as "the services set to start automatically that are not running", so responses are kept token-efficient. See Lightning Query Language.

Maintenance & Improvements:

• MCP tool descriptions were optimized to reduce inaccurate tool usage and improve AI client comprehension.
• When a query returns nothing, the response provides relevant hints for common mistakes (a misplaced quote, a filter that reached the wrong layer).
• More token-efficient response format: dense-tables (TSV) or JSONL is selected automatically to minimize output size without losing meaning.
• Any technical difficulties return a short incident id you can include in a support/feedback request when asking for help.

SparkLogs AI Plugin 1.6.0 (2026-09-08) - Feedback Skill, Device Health Playbooks

Features:

• Send feedback without leaving the session. The sparklogs-feedback skill securely sends your feedback to SparkLogs support. Help us improve, and send us your product ideas and bug reports.
• Device health playbooks: how to find unhealthy devices, stopped automatic services, process and service inventory, configuration changes, and numeric measurements per device (average and percentile).
• Configuration change guidance. What a config change row contains (object kind, action, identity, actor, principal acted on) and how to effectively query for it.

Maintenance & Improvements:

• More concise language: edited for brevity; removed MCP tool mechanics from plugin (replaced by MCP server tool descriptions)
• One vocabulary throughout: field name, column, row, response. Reference pages regenerated from Data Feed Pack 1.5.4, including the six themed Windows Event Log feeds.
• Plugin packaging fixed for Claude Desktop: Claude Desktop now includes all reference materials (Claude Code was unaffected).

Data Feed Pack 1.4.0 (2026-09-02) - Comprehensive Windows Event Feeds

Features:

• Five new Windows Event Log feeds (platform, storage, network, identity and security, management, apps) with basic curation: covers 100+ additional channels.
• Reference pages for every feed, code table and health topic are generated from the pack.
• Shared service table classifies vendor and product services (backup, EDR, RMM, database, mail, directory).
• Better decoding for Windows servicing errors.

Cloud Services v2026-09-02 - Ingest Credential Redaction

Features:

• Credential-shaped text is now redacted for all cloud-ingested events by default. Passwords in connection strings and key=value pairs, command-line password flags, PowerShell secure-string and credential constructors, encoded commands, URL userinfo, and bearer/vendor tokens are replaced with <redacted> before storage, including in nested fields and arrays. Set the X-Redact-Mode header to off to disable. Events with any change are marked __redacted; find them with the LQL expression __redacted!. See HTTPS JSON.

Data Feed Pack 1.3.0 (2026-08-31) - Curation of Windows Event Log (Application, System, Security)

Features:

• Less noise, clearer incidents across Application, System, and Security. Windows events are classified into named conditions with severity tuned for MSP triage, not Windows defaults. Routine servicing chatter, benign Volume Shadow Copy shapes, WMI registration notices, and similar high-volume lines stop crowding error views and AI summaries.
• Security and identity questions get direct answers. Account lockouts, Kerberos and TLS failures, SMB and NTFS access problems, MFA gaps that still allow logon, and endpoint isolation from your EDR show up as distinct conditions instead of opaque Event IDs. See IT Fleet Intelligence.
• Patch, install, and component-store failures name the problem. Failed updates, blocked servicing, and corrupted stores are separate actionable conditions. Hex status codes in messages decode to readable Windows error names where SparkLogs holds a mapping, so tickets and chat answers spend less time translating codes.
• Backup and VSS problems separated from benign events. Writer failures, provider registration gaps, and shadow-storage exhaustion are elevated; known-benign VSS activity during shutdown or optimization stays quiet.
• "What ran on this box?" with redacted command lines. Process command lines from Windows events are available for investigations and AI follow-ups; credential-shaped values in those lines are stripped before data leaves the endpoint.

Maintenance & Improvements:

• Group Policy drive-map and preference failures distinguish unreachable shares, bad credentials, and letter conflicts.
• Application stability covers crashes, hangs, and common server workloads (ASP.NET, SQL-adjacent faults, unhandled .NET exceptions).
• Broader coverage for Entra sync, certificate enrollment, VPN dial failures, and endpoint protection agent status.

SparkLogs AI Plugin 1.5.0 (2026-08-31) - OAuth Sign-In and More Accurate Investigations

Features:

• OAuth is the recommended auth for the bundled MCP connection. Sign in to SparkLogs in the browser when the host prompts. An API token remains available for headless or automation hosts that cannot open a browser. See Connect your AI.
• Investigations check coverage first: is this client or host in SparkLogs, and did events arrive, before treating silence as healthy. That avoids wasted log searches and wrong "nothing happened" answers.
• Device questions go to standing state (CPU, disk, software, services) when SparkLogs Agents are in scope. Ingest-key-only streams skip that path.
• Volume Shadow Copy (VSS) playbook for snapshot and writer problems, kept separate from backup job failure.
• Claude Team and Enterprise org-wide install is documented separately from personal Claude Code and Desktop. See Claude organization-wide deployment.
• Microsoft Copilot Studio connects over MCP with the agent instruction template. See Copilot Studio.

Maintenance & Improvements:

• Plugin ergonomics improved. Ask, investigate, and analyze-cause are skills: plain language is enough. The slash commands that remain are sparklogs-explain and sparklogs-summary. On Claude Code they appear as /sparklogs:sparklogs-explain and /sparklogs:sparklogs-summary. Update saved prompts that still called /sparklogs:ask or /sparklogs:investigate.
• Empty sparklogs.* fields on an event mean the event is uncurated. That is not a health finding. unknown on a feed is not "the device is unhealthy."
• Cause analysis stays a separate, labeled step. The default write-up is a cited system-condition summary, including what was not checked.
• More Application, System, Security, servicing, and Defender field and reason coverage from the current Data Feed Pack.
• Symptom playbooks are shorter. Guides for each kind of stream (Security vs Setup vs Defender vs device state vs file logs) so the right source is queried first.
• Pattern grouping still holds when the same kind of event has slightly different message text.
• A Windows application-name list so "what is installed" questions resolve to the product you mean.
• Query recipes can match items inside lists (nested Windows event fields).

Cloud Services v2026-08-31 - LQL Query Arrays of Objects; Pipeline Resiliency

Features:

• Query arrays of objects in LQL: path[](expr) matches when at least one element satisfies expr, and path[]! matches when the array is present. For example, find hosts whose services inventory includes the print spooler:

  sparklogs.kind=inventory sparklogs.topic=services sparklogs.data.services[](name="Spooler")

  See Lightning Query Language.

Maintenance & Improvements:

• Ingestion and query pipeline resiliency for better performance and reliability. Improved algorithms for flow control and reliability even under degraded or unexpected cloud conditions.
• Allow certain metadata updates to ingest keys and app registrations in all states (e.g., after revocation).

Application v2026-08-29v - UX Performance and Reliability

Maintenance & Improvements:

• UX Performance: minimized state and component rebuilds across the entire app, resulting in a snappier UX.
• Returning to the browser tab no longer interrupts page state: on tab reactivation open dialogs will stay open even when most workspace metadata changes. The Explore Data page will not rerun a query and interrupt your current diagnosis flow.
• Better error handling and API resiliency especially if the UX tab is left in an idle state for hours or days.
• Polished Workspace Access pages: better indicators for certain credential states, better filter state after credential creation, better progress indicators.
• Updated OAuth consent reconnection behavior: You can now immediately approve, review, or cancel, without waiting a few seconds. See Connect your AI.

Cloud Services v2026-08-26 - AI Connector Compatibility and Event Pattern Refinements

Maintenance & Improvements:

• AI connector compatibility: sign-in completes when the OAuth client omits scopes or sends extra names. Unknown names are dropped; recognized SparkLogs scopes are granted. A client that names none gets the default query scopes on the consent screen. See Connect your AI.
• Connectors can revoke their OAuth tokens when they disconnect, so a removed AI client does not leave a live refresh token.
• AutoExtract patterns group more tightly: Windows drive letters stay paths, hex runs collapse, and version numbers sort before dates.
• MCP pattern tools clarify the shown pattern text is a sample. Filter and join on pattern_hash.

SparkLogs Agent 1.9.10 (2026-08-26) - Auto-Update Resiliency

Features:

• Update checks survive daily reboots and sleep. The next check time is remembered across service restarts, so workday endpoints that power off overnight still reach a published build instead of starting a fresh 10-14 hour wait every morning. See How automatic updates work.
• Retries in the same wake window when a check hits a network that is not up yet (boot or resume from sleep), instead of waiting another full interval.
• Restores a missing Windows Installer cache for this agent's own package, so auto-update, repair, and uninstall keep working when that cached file is gone.
• Clearer auto-update status on the device. Configure > Agents shows when the last update check completed, and distinguishes an installer-cache problem from a failed installer run.

Maintenance & Improvements:

• An in-flight update is not reported as idle while the installer is still running.
• An already-downloaded update package is reused when the same version is still staged.

Data Feed Pack 1.2.8 (2026-08-21) - Windows Servicing Curation

Features:

• Windows servicing feeds (CBS/DISM) are now curated to actionable conditions and key events.
• Real component-store problems are reported as their own conditions, including corruption Windows detects, corruption it repairs, repairs that could not complete, and updates blocked by a damaged store.

Maintenance & Improvements:

• Several families Windows itself logs as errors are curated to reflect proper severity, including Volume Shadow Copy driver-enumeration messages during backups, WMI provider registration notices, drive optimization on virtual disks, and file-hash mismatches for content updated outside the servicing stack.

SparkLogs Agent 1.9.9 (2026-08-19) - Uninstall Status Visibility

Maintenance & Improvements:

• Clearer device status after a cloud-requested uninstall: the device shows as uninstalled when the agent software actually comes off the endpoint, and a removal that could not complete stays visible and retries instead of going quiet.

SparkLogs Agent 1.9.8 (2026-08-18) - Remote Deletion Lifecycle

Features:

• Deleted devices go quiet remotely. When you delete a device in the app, its agent stops collecting and idles, with no site visit. Undelete the device and it resumes on its own.
• Optional remote uninstall. A delete can carry an instruction for the endpoint: leave the agent idle, uninstall it, or uninstall and remove local agent state. The agent confirms the instruction twice before acting. See Delete and remote uninstall.
• Self-healing enrollment. An agent whose credential was superseded re-enrolls automatically with its original registration token instead of going silent.

Maintenance & Improvements:

• A refused enrollment (for a deleted device) states the reason and the device in both the agent log and the Windows Event Log, so a technician can resolve it without a support ticket.

Cloud Services v2026-08-18 - Device Ownership Moves and Sticky Deletion

Features:

• Move a device to another organization. Identity, collection state, and future data follow the device; data already collected stays with the organization that owned it at the time. Moves stick through wipes and reinstalls. See Moving devices and organizations.
• Move an organization under a different parent. Everything below it comes along, and access and history follow the new position immediately.
• Deletion sticks. A deleted device stays deleted through wipes, reinstalls, and disk-restore cycles; undelete is the way back. One delete covers one machine however many times it comes back.
• Any registration token in your workspace reconnects a device to its existing record, whichever token its deployment package carries.

Maintenance & Improvements:

• Simultaneous first enrollments of one machine can no longer create duplicate devices.
• An install never fails because the identity a machine reports is stale; the device receives a fresh identity and keeps working.
• Ownership and deletion changes propagate to running agents reliably, without waiting on caches.
• Compatibility with more MCP clients that probe optional server features.

Application v2026-08-18u - Device Ownership and Fleet Cleanup

Features:

• Change ownership moves a selected device to another organization from Configure > Agents. Deleted devices can be moved too, so a record can be tidied into the right organization before undelete. See Moving devices and organizations.
• Change parent moves an organization, with everything under it, to a new position in your org tree.
• Delete with an endpoint instruction. Deleting an agent can tell the endpoint what to do with itself: leave the agent idle, uninstall, or uninstall and remove local state.
• Filter the agents list by text. Type terms to match against everything shown on the rows; combines with the existing health chips.

Maintenance & Improvements:

• Clearer wording when a move succeeds but cached authorization is still expiring.

SparkLogs AI Plugin 1.4.2 (2026-08-18) - Loads Cleanly on Claude, Codex, and Cursor

Features:

• /sparklogs:analyze-cause is now a slash command on Claude, matching the documentation.
• Codex marketplace install. Add the repository as a Codex plugin marketplace and install; the SparkLogs MCP server comes bundled and authenticates with your API token.
• Claude Desktop install via Directory > Plugins > Add marketplace, with automatic plugin updates.

Maintenance & Improvements:

• The MCP server connects reliably on every supported host.
• Claude command names simplified: /sparklogs:ask, /sparklogs:investigate, /sparklogs:summary, /sparklogs:explain. Update saved prompts that used the older doubled form.
• Reference guides and playbooks cited by the skills now resolve on every host.
• Install guides rewritten per host, including token setup.

SparkLogs Agent 1.9.7 (2026-08-17) - Stable Device Names and Identity Resilience

Features:

• Stable device names on domain-joined endpoints. The reported name is composed from the machine's own name and its directory domain, so it no longer flaps when a VPN connection changes the connection-specific DNS suffix. Applies to Active Directory and Entra joined machines.
• Keeps its identity across reinstalls, wipes, and image restores. After a purge, a rebuild from an image, or a nightly disk-restore cycle, the endpoint returns to the device record it already owns instead of arriving as a new one. See Agent identity and cloning.
• Takes its own identity when a cloned installation is detected, so machines deployed from one image end up as separate devices without a technician visit.
• Resumes collection where the endpoint left off. After a reinstall or restore, telemetry data already uploaded is not sent again.

Maintenance & Improvements:

• Update checks are spread across the fleet by release ring (faster updates for certain rings).
• Check-ins pause while an update installer is running.

Cloud Services v2026-08-17 - Agent Identity Resilience

Features:

• One identity per device, across the machine lifecycle. A device keeps its record and its history through agent reinstalls, reimaging from a captured image, and daily disk-restore tools such as Deep Freeze. Repeated restore cycles do not add duplicate devices. See Agent identity and cloning.
• Cloned installations are detected and separated automatically. When one image is deployed to several machines without preparation, each machine receives its own device record within a short period, and the original keeps its history. Preparing the image is still cleaner: see Prepare a golden image.
• Ingest resumes instead of restarting. An endpoint that re-enrolls after a reinstall or restore does not re-upload log data it already sent, so a fleet of frozen machines does not re-ingest the same history on every thaw.

Maintenance & Improvements:

• More reliable request handling under client disconnects and retries.

SparkLogs AI Plugin 1.4.0 (2026-08-17) - Chat-First Answers and Symptom Playbooks

Features:

• /sparklogs-ask answers a question about a host or a fleet in ordinary chat, with cited queries and follow-ups, and no report template. /sparklogs-investigate stays the written pass when you want the artifact for a ticket. See Chat with your data.
• Ten symptom playbooks as query recipes: backup job failure, BitLocker recovery, certificate expiry, directory replication, disk full or filling, memory or handle leak, RAID or array degraded, RMM connectivity, slow logon, and Windows Update failure.
• Topic guides route a question to the right data first: device health and state, endpoint protection, Windows operational events, Windows security and audit, and Windows updates and patching.
• Reference sets for every collected data feed, covering the fields that exist at rest, the values you can group by, what each event reason means, expected patterns, worked query recipes, and ECS and OCSF anchors.
• Device questions start with device state. "What is on the box", installed backup products, CPU, memory, and disk go to device health first rather than a log search.

Maintenance & Improvements:

• Investigation and cause-analysis skills follow the current MCP tool surface.

Application v2026-08-15m - Update Notification and Info Bar Refresh

Features:

• A banner appears when a newer version of the app is available. Choose Reload to pick it up right away, or Later to keep working and reload on your own schedule.

Maintenance & Improvements:

• Refreshed info bar styling across the app, with consistent notice colors in light and dark themes.
• Sign-in waits until your profile has loaded, so the first page after login is the one you expect.

Application v2026-08-14j - Agent Fleet Health and Triage

Features:

• See agent health at a glance on Configure > Agents. Each row shows device type (workstation, server, or ingest key), connectivity, and collection status in one badge. Filter the list with chips for All, Needs attention, Offline, and Inactive (long-silent endpoints), and sort by health, name, or last check-in. See Manage and verify agents.
• Rebuilt agent detail pane with expandable Properties, System Details, and Data feeds sections. Status pills match the list; a plain-language line explains why an agent needs attention. Per-feed collection health, auto-update status, skipped-events notices, and matched-file counts on file sources help you decide what needs human attention.
• Host facts in the UI: friendly Windows version names, device class, domain-controller role when reported, and service state when the agent announces stopped, shutdown, uninstalled, or an in-progress upgrade.
• Home dashboard fleet summary aligned with the Agents list. Notices for agents needing attention or offline are links: they open Configure > Agents with the matching filter, sub-orgs included, and the org tree moved to a root that actually has matching endpoints.

Maintenance & Improvements:

• Include sub-orgs is on by default when browsing agents, so MSP fleets see client endpoints without an extra toggle.
• Clearer agent and feed vocabulary across the list, detail pane, and dashboard (consistent "data feed" wording and filter tooltips).
• Clearer troubleshooting when a data feed pack is still downloading (wait-time guidance and outbound HTTPS checks).
• Agents layout polish: wider list column on wide screens, improved detail-pane scrolling, and muted device icons when an endpoint is offline.
• Workspace API tokens: grantable MCP scopes are selected by default when you mint a new token. See Access.

Cloud Services v2026-08-14 - MCP for AI Assistants

Features:

• MCP for AI assistants. Connect Claude, Cursor, Codex, or your own MCP client to SparkLogs and query telemetry in the authenticated workspace. Sign in with a workspace API token or OAuth under Workspace Settings > Access. Simple questions can be answered in ordinary chat; a full investigation is optional. See IT Fleet Intelligence and Connect your AI.
• Investigate with LQL: search events, page or refine a result, and list sources and scope for a client or endpoint.
• Pattern and health tools: pattern stats with optional examples, event counts by severity, and device health for SparkLogs Agents (including silent devices).
• See the live demo.

Maintenance & Improvements:

• Sampled aggregates are labeled so a partial count is not presented as complete.
• Results stay inside the authenticated workspace and organization scope.

SparkLogs AI Plugin 1.3.0 (2026-08-14) - Investigation Workflow

Features:

• SparkLogs AI plugin for Claude Code, Cursor, and Codex. Install from the SparkLogs AI Plugins marketplace (itlightning/sparklogs-ai-plugins), then connect with OAuth or a workspace API token. Chat with your data and follow up as far as the issue goes; run /sparklogs-investigate when you want the written report.
• /sparklogs-investigate gathers evidence and writes a cited system-condition summary (agentic RCA).
• /sparklogs-analyze-cause is an explicit second step: candidate hypotheses with confirm/refute checks, labeled as analysis rather than fact.
• /sparklogs-summary and /sparklogs-explain re-render a summary for tickets or walk a specific claim back to evidence.
• Windows Security investigation playbooks follow the current MCP discovery and pattern tools.

SparkLogs Agent 1.9.6 (2026-08-14) - Comprehensive Collection Health Reporting

Features:

• Waits until collection is measured before reporting health. After reboot or sleep, Configure > Agents no longer flash an unknown or needs-attention state while feeds are still starting.
• Proper status reporting on filtered Windows event log channels.
• Empty file logs count as healthy. A CBS/DISM-style feed with no files yet is current, not stuck.
• Clearer Event Log task names on collected events.

Maintenance & Improvements:

• Heartbeats include the collector's own feed, or report when that feed is missing.

Data Feed Pack 1.2.7 (2026-08-13) - Security Channel Curation

Features:

• Kept directory object access (4662) is classified by meaning: Notable for real access-check shapes, Warning for replication-access shapes.
• Blocked Filtering Platform connections (5157) stay at Verbose.

Maintenance & Improvements:

• Long security payloads are trimmed at a declared bound.
• CBS/DISM servicing poll-narration tail is omitted.

Data Feed Pack 1.2.6 (2026-08-13) - Security Channel Curation

Features:

• Security collection omits families Microsoft and common SIEM filters treat as non-signal, including filter-engine churn (5447, 5449), handle close/duplicate (4658, 4690), bind records (5158), and IPsec 4985. These events remain in the endpoint Event Log.
• Audit-useful shapes in these families are kept, including sensitive privilege use (4703, 4673) and failed or replication-related directory access (4662). This keep-set is wider than typical default SIEM filters.

Maintenance & Improvements:

• CBS/DISM session-start banners are omitted.

SparkLogs Agent 1.9.5 (2026-08-12) - Accurate File-feed Health

Features:

• File log feeds report real catch-up. CBS/DISM-class sources freshness is reported accurately in all cases.

Maintenance & Improvements:

• Additional pipeline drain resiliency during collector service stop.

SparkLogs Agent 1.9.4 (2026-08-11) - Stop Reason and Quieter Endpoints

Features:

• Reports why the Windows service stopped (stop, shutdown, uninstall, or upgrade). Configure > Agents shows that reason instead of a silent offline.

Maintenance & Improvements:

• At least 20% lower memory usage on typical endpoints.
• Clearer agent logs when cloud API calls fail.

Data Feed Pack 1.2.5 (2026-08-11) - Stable Feed ID

Features:

• Each data feed carries sparklogs.feed.id, a stable identifier independent of display name.

Data Feed Pack 1.2.4 (2026-08-11) - Security Channel Curation

Features:

• Security account-lifecycle family is split.
• Eventlog 1100 (logging stopped), 1101 (transport discarded audit records), and domain policy change 4739 are classified.

SparkLogs Agent 1.9.2 (2026-08-10) - Device Class and Skipped Event Reporting

Features:

• Reports workstation vs server, and domain-controller role when present, for the fleet health UI on Configure > Agents.
• Reports skipped-event spans when Windows Event Log can detect collection skips. Shown as skipped events in the agent detail pane.

SparkLogs Agent 1.9.0 (2026-08-09) - Per-source Collection Health

Features:

• Per-source collection health on each check-in (quiet and caught up vs behind or stuck), including Event Log channel status.

Maintenance & Improvements:

• More resilient drain of all pending events in flight during a service stop.
• The collector config check is cancelled promptly when Windows asks the agent service to stop.

Data Feed Pack 1.2.3 (2026-08-09) - Security Decode Fixes

Features:

• Clock-change events (4616) use the values Windows actually wrote.
• PowerShell Direct handshake 4625 is not treated as a real logon failure.

Maintenance & Improvements:

• CBS session preamble is out of the Verbose band.

SparkLogs Agent 1.8.1 (2026-08-08) - Event Log Recovery

Features:

• Windows Event Log collection recovers from a dead subscription. If the underlying Windows Event log channel subscription gets stuck and stops delivering events, automatically self-heal and restart collection with a new subscription exactly where we left off.

Maintenance & Improvements:

• Substantially faster collector startup after a restart.

Cloud Services v2026-08-07 - Bidirectional Control Character Stripping

Features:

• Unicode bidirectional control characters are stripped at ingest from every string value before field extraction and pattern analysis. Stored text, patterns, and searches match what you see on screen, and a common text-spoofing vector is removed; no letters are ever removed. Set X-No-Strip-Bidi-Controls: true (or no_strip_bidi_controls=true) on HTTPS+JSON requests when you need exact mixed right-to-left and left-to-right display fidelity. See ingest control fields.

SparkLogs Agent 1.7.9 (2026-08-06) - Safer Updates and Permissions

Maintenance & Improvements:

• Automatic updates refuse a replacement binary that has no version, as a defense-in-depth to preserve working installs.
• The agent repairs and strengthens its working-directory permissions automatically.

SparkLogs Agent 1.7.8 (2026-08-06) - Cleaner Upgrades on Disk

Maintenance & Improvements:

• Uninstall and upgrade more thoroughly remove leftover collector cache and state.
• Data feed pack apply spends less CPU during service start, so data starts flowing faster.

Data Feed Pack 1.2.2 (2026-08-06) - Enhanced Security Channel Curation

Features:

• Process create (4688), credential-manager reads, crypto ops, audit-log cleared / time change, and enumeration shapes (4798, 4799) are classified.
• Clearer event when a Windows Event Log channel is not collected.

Cloud Services v2026-08-05 - Enhanced Bare-term LQL Search

Features:

• A bare LQL term also matches subsource, service, category, span_id, and companion *_hash fields. Typing a subsource such as win.servicing.dism finds those events; previously only any: did. See Lightning Query Language.

Maintenance & Improvements:

• field! on empty standard columns has the same semantics as for custom fields (non-NULL and not empty) (for example trace_id!).

Application v2026-08-04o - Dashboard and Explore

Features:

• Home ingestion dashboard defaults to grouping by organization, so MSP workspaces see per-client volume without changing the control first.
• Explore severity histogram shows all seven standard severity levels in the chart grid.

Data Feed Pack 1.2.1 (2026-08-04) - Security Logons

Features:

• Failed logon and lockout cause is decoded from NTSTATUS (4625 and related).
• Kerberos and NTLM failures, including the RC4 service-ticket downgrade signal.
• Sign-in (4624), special privileges (4672), and group grant / membership use an account identity, not a person claim.

Maintenance & Improvements:

• CBS scan tally is split into separate facts.

Application v2026-07-29g - API Access, MCP oAuth Consent, and Ingest Policy

Features:

• Workspace Settings > Access: mint, rename, and revoke workspace API tokens with scoped permissions. Token revocation stops the token immediately and cannot be undone from this screen.
• OAuth consent for connected apps (including MCP integrations): approve requested scopes on a dedicated consent screen; list or disconnect apps that already have access.
• Ingest policy settings under Workspace settings, with defaults seeded by the setup wizard. Control workspace-level severity caps for uncurated ingestion; see HTTPS+JSON ingest.
• Explore updates: revised severity ladder presentation and an MSP-oriented context relax-ladder order. source_hash is available as a standard explore field alongside source for stable grouping.
• Organization editor: set RMM/PSA client IDs on an org with duplicate-ID warnings before you save.

Maintenance & Improvements:

• Setup wizard opens reliably when you create or switch into a workspace that still needs onboarding.
• Smoother workspace join and invitation flows, including a logout notice on the login page when your session ended.
• Permission, org-tree, and archiving fixes for edge cases during workspace lifecycle and role changes.

Cloud Services v2026-07-29 - Ingest Control Fields

Features:

• X-No-Extract-Fields: skip custom-field extraction from message text while still detecting category, severity, and timestamp. See HTTPS+JSON ingest.
• X-Drop-Older-Than-Secs: skip events older than the stated window; the HTTP request still succeeds.
• An empty category_override is authoritative: a blank override means no category. If the field is unset, then the automatic category detection is used.

Data Feed Pack 1.1.1 (2026-07-29) - Windows Event Log and Defender

Features:

• Classic Windows Event Log channels: Security, System, Application, and Setup.
• Microsoft Defender Operational (detections, protection off, definition and engine failures).
• The agent's own operational log (startup, ingest errors, spool) is queryable like any other data feed.
• Shaped events carry a consistent app grouping field.

Application v2026-07-22q - Setup Wizard Polish

Maintenance & Improvements:

• Setup wizard behaves correctly with existing organizations and tokens (recommended mode, no duplicate token or ingest-key creation, scaffold actions bound to the right org).
• Invitation emails are normalized to lowercase so invites match regardless of how the address was typed.
• Auth routing and Help Center fixes for workspace context and sign-in edge cases.

Cloud Services v2026-07-15 - Scope Discovery Archive Tables

Features:

• Hourly scope and pattern aggregate tables in the archived data lake. Archives can now include materialized-view summaries for scope ladder and per-pattern statistics (logs_scope_ladder, logs_patterns), with expanded logs_sources exports. Tables appear in your replicated bucket as your workspace is upgraded. See Archive Data Format.

Cloud Services v2026-07-10 - Companion Hash Fields

Features:

• Companion hash fields at ingest for key standard fields: pattern_hash, source_hash, subsource_hash, category_hash, service_hash, and app_hash. Each is a compact, stable identifier for its base value, computed in the cloud after normalization, so you can pin filters, group results, and hand a short token between tools without carrying the full text. See hash fields.

SparkLogs Agent 1.6.3 (2026-07-10) - Defender Channel and Upgrades

Features:

• Windows Defender Operational channel added to the standard Windows Event Log data feed pack, so Defender operational events are collected with the rest of the endpoint sources.
• Clearer first-hop identity on agent logs: host identity and locality are stamped on collected events, with observed_timestamp and related fields aligned for fleet-wide grouping. Normalized subsource values stay comparable across machines; see subsource normalization.

Maintenance & Improvements:

• More reliable Windows upgrades and uninstalls, including safer rollback and recovery if an update is interrupted.
• Data feed pack updates validate before they replace a good install; corrupt or unexpected packs are rejected without degrading collection.

SparkLogs Agent 1.6.2 (2026-07-02) - Windows Early Access

Features:

• The SparkLogs Agent for Windows, now in early access. A first-party, signed, self-updating endpoint agent that automatically discovers and collects operating system and application logs plus system health signals. No collector configs to write and no per-endpoint maintenance: install it and data flows. Supports Windows 10+ and Windows Server 2016+ (x64); macOS and Linux agents are on the roadmap; unofficial support for Win 8.1 and Server 2012 R2.
• Built for MSP fleets. Pass your RMM or PSA client ID at install time and every endpoint is automatically mapped to a per-client organization (created on first registration), so each client's data stays isolated and each client's fleet can be queried and managed on its own. See deployment scope.
• Hardened security. Outbound-only HTTPS, no inbound ports, no remote-execution capability, written in pure Rust, with two independent signature chains covering installs and automatic updates. See agent security and the Trust Center.

Data Feed Pack 1.0.0 (2026-07-02) - Windows Servicing Logs

Features:

• Windows CBS and DISM file logs. Component-store corruption, SFC/DISM repair, and servicing outcomes. Routine per-package census is omitted. Query at Info or above for investigation.

Application v2026-07-02 - Deploy Agents and Ingest Keys

Features:

• Deploy Agents wizard. A guided flow in Configure > Agents: choose your deployment scope, get a signature-verified download with its SHA-256, and copy ready-to-run commands for your RMM, Group Policy, Microsoft Intune, a single machine, or PowerShell. Roll the agent out across an entire client base in one afternoon. See deployment methods.
• Your whole fleet at a glance. The new Agents tab lists every SparkLogs Agent with version, OS, and last check-in, and tells you plainly when an agent is enrolled but not yet collecting. Clone detection flags credential reuse from cloned machine images.
• Registration tokens enroll agents into exactly the part of your organization tree you choose. Label them, set expirations, and revoke or restore them at any time.
• Configure is now Agents plus Ingest Keys. Managed endpoints live in the new Agents tab. The credentials formerly labeled "Agents" are now Ingest Keys (for collectors, SDKs, and APIs); they work exactly as before, and nothing changes for existing pipelines.
• New documentation: Deploy and Manage Agents, covering registration tokens, download and verification, every deployment method, ongoing management, and troubleshooting.

Maintenance & Improvements:

• Configure page layout improvements for narrow and stacked viewports.

Application v2026-06-25 - Workspace Setup Wizard and Guided Tours

Features:

• Workspace Setup Wizard. Tell us how you use SparkLogs (MSP / IT, Game / App Developer, SRE / Dev) and the wizard creates the recommended organization hierarchy and credentials for you. MSPs get an Internal IT plus Clients structure with registration tokens ready to deploy; developers get Dev, Staging, and Production with Ingest Keys. Review everything before it runs (nothing changes until you confirm), invite teammates along the way, and continue later at any point. You finish on a checklist of concrete next steps, like deploying the agent and confirming data in Explore.
• First-visit guided tours. Configure pages (Organizations, Agents, Ingest Keys, Archiving) and Explore now offer a quick tour that points out what matters on the page. Revisit any tour via the Help button ("Show tips for this page").

Website v2026-06-12 - Live Demo, Trust Center, Company Story and Leadership, and Search

Features:

• Live demo on the homepage: an interactive, ~3-minute replay of a real SparkLogs MCP investigation (query logs, check system state, trace root cause). Browse chapters, read the transcript, and see how SparkLogs delivers an AI-assisted troubleshooting workflow.
• Trust Center documents how SparkLogs protects your data in one place: Google Cloud infrastructure, encryption, data residency by region, tenant isolation, agent security, change control, availability, compliance posture, subprocessors, and responsible disclosure.
• Company page with our story, leadership team, and mission. Read how the product grew out of real MSP operations work and meet the people behind SparkLogs.
• Site-wide search now covers documentation and all other pages (pricing, use cases, company, Trust Center, and more). Find answers from any page via the header search bar or /search.

Maintenance & Improvements:

• Visual refresh: updated colors, typography, and section layout for clearer reading on desktop and mobile.
• Navigation updates: Trust Center and operational status are easier to reach from the header and footer; Company links are grouped in one dropdown.

Cloud Services v2026-06-01 - Dotted Field Normalization

Features:

• Flat JSON keys with dots are nested on ingest so stored custom fields match LQL path syntax; see dotted field names in JSON payloads (opt out via X-No-Normalize-Dotted-Field-Names).

Cloud Services v2026-05-26 - 3 New Regions: CA, AU, UK

Features:

• 3 new regions for Cloud Services: Canada, Australia, and UK.
  • Canada: ca (Montréal)
  • Australia: au (Sydney)
  • UK: uk (London)
• Regional pricing updated to reflect higher infrastructure costs in AU and UK.

Application v2026-05-26k - UX Polish

Maintenance & Improvements:

• Clearer warnings when permission caches cannot be refreshed. After successful changes to workspace user roles or organization/Ingest Key delete and restore, the app warns if cached permissions could not be cleared immediately so you know configuration data may be stale for a few minutes.
• Visual layout fixes for Ingest Key configuration text selection. Multi-line text selection within Ingest Key config templates now works correctly.
• More consistent app messages for success, failure, and warning messages (toasts, info bars, and dialogs).
• Workspace name in page and window titles on workspace-scoped pages.
• Home dashboard refreshes when workspace provisioning completes, so quota and ingestion widgets show the correct state without a manual reload.

Application v2026-05-22u - Unreal Engine Config Template

Features:

• Unreal Engine configuration template in Configure Ingest Keys. Copy-ready DefaultEngine.ini snippets for server, editor, and client launch configurations, with links to Unreal Engine ingestion docs.

Maintenance & Improvements:

• Smoother workspace switching on Explore, App Analytics, the home dashboard, and configuration pages. Spurious technical error notices during workspace changes are resolved.

Application v2026-05-21v - Private Cloud Archive Guidance

Maintenance & Improvements:

• More reliable workspace provisioning to avoid race conditions during certain UX conditions.
• **Improved guidance for private cloud archive bucket setup.

Application v2026-05-13t - Scope Pivots and OpenTelemetry

Features:

• Filter and explore by the new subsource and service standard fields. Use them in LQL queries, dashboards, and pinned filters the same way you use source and app.
• 5-level scope hierarchy in context exploration. The relax-ladder now walks subsource, source, service, app, organization_id, narrowing or widening the query scope one level at a time. Useful when drilling from a single pod's stdout up to "everything in this cluster".
• Ingest Key configuration templates now use native OTLP. New collector setups in the workspace ship with OpenTelemetry-compatible config out of the box.

Cloud Services v2026-05-13 - Expanded Source Coverage and Scope Pivots

Features:

• Two new standard fields for context exploration:
  • subsource: the most granular scope value (log filename, container stream, Windows Event Log channel, OTel instrumentation scope name, specific resource being acted on). Combines with source, service, app, and organization_id to form a 5-level scope hierarchy for context-aware exploration.
  • service: logical service or workload identity (e.g. OTel service.name, Kubernetes workload names, or the SaaS product name for connector-ingested data).
• Automatic pivot detection and standard field mapping for many more log sources. No per-source configuration required. New first-class support:
  • Agents and collectors: Vector kubernetes_logs, windows_event_log, journald, docker_logs, and file sources; Fluent Bit Kubernetes filter; Promtail / Grafana Alloy / Loki labels; Datadog Agent forwarded payloads; Splunk HTTP Event Collector.
  • Cloud services and serverless: AWS Lambda, AWS ECS / Fargate, GCP Cloud Run, GCP Cloud Audit Logs, Azure Functions, Azure App Service, Azure ContainerLogV2 (AKS), Azure Application Insights, Fly.io, Heroku Logplex.
  • See the full standard field mapping table for the exact pivots each source resolves.
• Smart collision handling. Senders whose field names overlap with SparkLogs's canonical fields are detected and remapped automatically. For example, Heroku's source field (which means "log producer", e.g. app / heroku-router) and Splunk HEC's source field (typically a file path) are routed to subsource, preserving the customer's original meaning while keeping source consistent with its system-wide definition.
• Severity-scale translation. Vendor-specific severity scales are translated to the standard OpenTelemetry 1–24 scale automatically:
  • systemd journald PRIORITY (syslog 0=emerg, 7=debug)
  • Azure Application Insights SeverityLevel (0=Verbose, 4=Critical)
• Composite source values. When a single field can't identify the producing instance, the composite is built automatically:
  • Kubernetes: <namespace>/<pod> from k8s.namespace.name + k8s.pod.name (or the Fluent Bit / Vector equivalents).
  • AWS service events: <account>/<region> for CloudTrail and GuardDuty findings.
  • Stripe events: live or test from the livemode flag.
  • Heroku: heroku/<source>/<dyno> from the renamed source field plus dyno.

Cloud Services v2026-05-08 - OTLP/HTTP Log Ingestion

Features:

• Native OpenTelemetry log ingestion via OTLP/HTTP: First-class support for the OpenTelemetry Collector (otlphttp exporter), every OTel SDK (Python, Node.js, Go, Java, .NET, Rust, …), Grafana Alloy, and any OTLP-compliant shipper.
  • Encodings: application/json and application/x-protobuf.
  • Compression: zstd, gzip, deflate, zlib, snappy, lz4, lz4-block, and identity.
  • Smart resource-attribute mapping: source, service, app, and subsource auto-derived from documented OpenTelemetry semantic conventions (service.name, service.namespace, k8s.cluster.name, k8s.namespace.name/k8s.pod.name, faas.instance, host.name, instrumentation scope.name, and many more). No custom mappings required.
  • Trace correlation: trace_id and span_id populated from OTel correlation context, so events from instrumented apps stay linked across services.
  • Built-in reliability: request deduplication, clock-drift correction, and defense against malformed and DoS payloads.

Application v2026-04-16 - App Analytics

Features:

• Game Engine Analytics is now App Analytics: the same session, retention, engagement, and monetization analytics, renamed for what it does: analytics for any application, not only games.
• The Overview dashboard now runs on your live workspace data, replacing the earlier preview experience.
• New Dashboards tab with built-in dashboards for common analytics questions.
• Chart property editor: choose the fields each tile displays, set number formats, and tune table options. New chart types include pie, donut, bar, and world map.
• Richer chart interactions: zoom and pan (Alt + scroll wheel), reset zoom, full-screen tiles, and optional data labels and markers.
• First-visit guided tour of the App Analytics Overview page.

Unreal Engine Plugin v1.0.10 [2026-04-13]

Maintenance & Improvements:

• Adopt new naming conventions from App Analytics name
• Include the ad action in the ad event ID hierarchy
• Minor fix to session duration validation logic when a session ends

Cloud Services v2026-02-06 - AutoExtract Root Field Customization

• The name of the root field that receives AutoExtracted data can now be customized (by default this is x).
• AutoExtracted fields can now be extracted into the root of the event instead of a nested field by setting the AutoExtract root field name parameter to $.

Application v2026-02-04k - Archiving and Replication

Features:

• Archiving and Replication: Replicate all your data to your own cloud storage bucket (AWS S3, GCS, Azure Blob Storage, or any S3-compatible storage) for compliance, disaster recovery, or geographic distribution.
  • Archived data is stored in a ready-to-query parquet hive-partitioned format.
  • Allows you to create a Data Lake of all your observability in a ready-to-query format from many popular Big Data platforms.
  • See Archive and Replication Overview for more details.
• Button on workspace settings page to allow self-service enablement of App Analytics feature

Cloud Services v2025-10-27 - Event Size Trimming

Features:

• Automatic event size trimming: Enforce limits on the size of each individual event: 512KiB for one log message and 3328KiB for custom field data in one event.
  • Individual events that exceed these limits will be automatically trimmed to fit within the allowed size.
  • Events that are trimmed in this way will have the custom __event_truncated_details field with details on what was trimmed. The LQL expression __event_truncated_details! can find all events that were trimmed.
  • This behavior can be customized through the X-Fail-When-Event-Too-Big header parameter.
• Increase max ingestion payload request size to 40 MB.

Maintenance & Improvements:

• Enhance supportability to diagnose failed authorization attempts and the associated workspace.

Cloud Services v2025-10-15 - App Analytics Snapshots

Features:

• Add automatic daily snapshots for app analytics data. Makes it easy to analyze long-term trends for DAU/MAU, retention, engagement, monetization, and more.
  • Snapshot cohorts can be segmented by user tags, install date, first purchase date, location, app version, and more.
  • Snapshots are retained for 7 years on paid plans.

Application v2025-10-13q - Download Org List

Features:

• Download organization list in CSV format.

Maintenance & Improvements:

• Improve display of lagging ingestion agents on dashboard.

Cloud Services v2025-10-08 - OpenTelemetry Collector Support

Features:

• Add support to ingest data from OpenTelemetry Collector. Detection is automatic. No configuration is required.
• Add search index support for integer and timestamp data types.

Maintenance & Improvements:

• Improve ingestion payload deduplication to dedup ingest payloads as small as 1KB.
• If there is no detected source field value for an event but the app field has a value, then also use the app field value for source.

Cloud Services v2025-09-23 - Materialized Views for App Analytics

Features:

• Add materialized views for app analytics data. Makes it easy and efficient to analyze analytics data and to analyze trends by analytics event ID.
  • Materialized views are always fresh and instantly up to date as new analytics data is ingested.

Unreal Engine Plugin v1.0.9 [2025-09-15]

Features:

• Dedup payloads across game engine crashes: enhances the plugin so that if a game engine process crashes after sending a payload and before it receives an acknowledgement of that payload, when the game engine restarts it will send the same payload again if possible.
  • It does this by remembering the size of the last payload as well as any common metadata used by the last game engine instance, allowing it to reconstruct an identical payload from the queue file.
  • This will allow the SparkLogs cloud to dedup such identical payload and prevent duplicate data from being received, even across game engine crashes/restarts.
• Persist any custom analytics user ID across game engine restarts

Maintenance & Improvements:

• Reduce client batch interval to 12 seconds (send analytics data faster).
• Use dedicated state INI file on desktop platforms (avoid rewriting larger user settings INI file now that we rewrite state more often).
• Synchronize any physical writes of the INI file to avoid racing on this.
• Fix unit tests randomly failing because of Unreal Engine caching old unit test state INI files.

Unreal Engine Plugin v1.0.8 [2025-08-29]

Maintenance & Improvements:

• Client build configurations will send queued data after 30 seconds.
• Adjust timeouts during shutdown so that at least 1 retry will happen no matter what.

Unreal Engine Plugin v1.0.7 [2025-08-26]

Features:

• Support multiple concurrent Unreal Engine game instances running at the same time for all types of data (including analytics data).

Maintenance & Improvements:

• Compatibility fixes for Unreal Engine 5.

Unreal Engine Plugin v1.0.6 [2025-08-25]

Features:

• Support multiple concurrent Unreal Engine game instances running at the same time (common in editor mode and QA environments) for log data data.

Maintenance & Improvements:

• The g_analytics.game_id field is renamed to g_analytics.app_id

Unreal Engine Plugin v1.0.5 [2025-08-19]

Features:

• Greater resiliency for progress markers: prevent duplicate analytics data from being sent when there is third-party interference clearing the queued data file on engine shutdown.

Maintenance & Improvements:

• Rotate the plugin ops log on startup if it's more than 5 MB (only affects servers).
• Log session ID in default message for session start/end.
• Only log value in default message if it's not null.
• Wait up to 15 seconds instead of 6 for final flush at end of game.

Unreal Engine Plugin v1.0.4 [2025-08-15]

Features:

• First purchased timestamp in analytics data: The purchase analytics event now includes a first_purchased field with the timestamp of the first time a purchase was made since the game was installed.

Unreal Engine Plugin v1.0.3 [2025-08-15] - Analytics User Tags

Features:

• User tags for analytics data: You can now set custom user tags to segment analytics data.
• Ad impression analytics events: The ad analytics event type was added to record analytics data for ad impressions.

Maintenance & Improvements:

• Purchase events properly record the transaction_num field value.

Unreal Engine Plugin v1.0.2 [2025-08-11] - Support UE5 & Linux

Features:

• Automatically adjust for inaccurate client clocks (uses the X-Client-Clock-Utc-Now ingestion request header).
• Add compatibility for Unreal Engine up through version 5.6.
• Add compatibility with Linux servers.
• Support ingestion session affinity for SparkLogs cloud (improves performance through better caching).

Maintenance & Improvements:

• Analytics sessions automatically start on servers as needed.
• Add plugin setting AnalyticsTargetCurrency to set the target currency for automatic currency conversion.
• Eliminate race condition during engine startup if plugin is manually initialized.
• Add FSparkLogsEngineOptions struct to group engine options together.

Cloud Services v2025-08-08 - Foreign Currency Conversion

Features:

• Automatic foreign currency conversion from over 200 currencies to a choice of 10 base currencies (e.g., USD, EUR, etc.).
  • Makes it easy to normalize financial data in log or app analytics data.
  • Currency conversion rates are automatically updated daily.

Cloud Services v2025-07-29 - GeoIP Lookups

Features:

• Automatic GeoIP lookup for all IPs detected in ingested data and for the client IP submitting the ingestion request.
  • GeoIP lookups are best effort and use publicly available information to estimate the country of origin for IP addresses.
  • The country of the IP address of the client submitting the ingestion request is stored in the client_ip_location field.
  • GeoIP lookups for all IP addresses detected by AutoExtract are stored in the x.ips_location[] string array field. You can use LQL queries like x.ips_location=US or x.ips_location=(US,CA,DE) to find events with IP addresses associated with certain countries.
  • GeoIP can be disabled by setting the X-Calc-GeoIP header parameter to false in ingestion requests.

Cloud Services v2025-07-23

Features:

• AutoExtract can now be disabled on a per-event basis by setting the __autoextract_disabled field to true in an event's metadata.
  • This is useful if you want to disable AutoExtract from extracting fields for only a subset of events in a particular ingestion payload.

Unreal Engine Plugin v1.0.1 [2025-07-04] - App Analytics

Features:

• Ability to capture and send App Analytics data:
  • Use the plugin to manage analytics sessions and capture design, progression, purchases, ads, resources, and error events.
  • Implements the standard Unreal Engine analytics interface so that existing analytics code works seamlessly.
  • Robust implementation captures analytics data even across game crashes, restarts, and periods when the machine is offline.
  • Supports both desktop, mobile, and server engine platforms.

Application v2025-50-20r - Improved Query UX

Maintenance & Improvements:

• Higher contrast and more compact log text display: remove horizontal gridlines, tighten spacing.
• Revamped event text rendering: 2x-3x faster scrolling through large result sets + smooth scrollbar scrolling.
• Load up to ~8000 matching events at a time (was 2000/query): helps you browse matching events faster and with fewer cloud queries. Browse up to 24000 matching events at a time.
• Fully precise text-wrapping: Fixes the display of very long events that wrap at odd points (e.g., large JSON objects).
• Better text selection support: Many text selection quirks were resolved. Text selection is now on by default in the matching event list.

Cloud Services v2025-04-24

Maintenance & Improvements:

• Optimize performance of full-text search index for certain international character encodings.

Cloud Services v2025-04-21 - Automatic Syslog Parsing

Features:

• Automatic Syslog Parsing:
  • Automatically parse (semi) compliant syslog formats including RFC3164 and RFC5424, as well as many proprietary formats including Cisco, Juniper, SonicWall, WatchGuard, and Fortinet.
  • This includes proprietary formats that use key-value pair values after a syslog header.

Maintenance & Improvements:

• Greatly improve recognition of edge case date/time formats, including odd ones that put the year after the time.
• AutoExtract recognizes MAC addresses for AutoClassify.

Cloud Services v2025-02-17 - Self-Hosted Querying Service Plan

Features:

• Launch Self-Hosted Querying service plan with even greater cost savings for large-scale environments.

Cloud Services v2025-01-28 - Quota Feature

Features:

• Quota feature that allows setting hard limits on data ingestion per workspace per calendar month.
  • When the quota is reached, further ingestion is blocked until the start of the next calendar month.
  • Useful to enforce maximum monthly spend as well as enforce limits on certain service plans.

Application v2025-01-20x - Billable Usage Reporting

Features:

• Adds billable usage reporting capabilities:
  • The ingested bytes chart on the dashboard lets you group by top agents or top organizations (defaults to by agent). The top 10 agents/organizations will be shown visually.
  • You can download a CSV report of all of the details behind the ingested bytes chart, which will have the details of all agents/organizations, not just the top 10.
  • On dashboard you can choose MTD, last month, or 2 months ago, etc., to help explore specific billable periods.

Maintenance & Improvements:

• The dashboard now displays agents that previously were actively ingesting data but have not ingested any data in the last 2 hours. These agents will continue to be considered as lagging for 7 days.
• The new agent / view agent API key dialog now displays template configurations for supported log forwarding tools & APIs.
• The agent details pane now displays the name of the organization that owns the agent.

Application v2025-01-09a

Maintenance & Improvements:

• Improve massive-scale adaptive query performance and accuracy:
  • Fixes histogram bucket behavior for adaptive-scale queries.
  • More accurate events search for estimated query results.
  • Clarify language when results are estimated that zooming in will add more precision.
• When toggling text selection preserve visible events.
• Fix scrolling in date/time picker using mouse wheel.
• Upgrade to Flutter 3.27 and reduce CPU/GPU overhead when app is idle.
• Copying a field or events as LQL will use equals operator for greater efficiency.

Application v2025-01-02w - Massive-Scale Adaptive Querying

Features:

• Massive-Scale Adaptive Querying Feature:
  • Quickly query any scale of data in seconds -- queries over large time scales (e.g., weeks/months/years) will now be very fast and show estimated results.
  • Estimated results will be shown on the histogram using a stacked area graph to convey shape; precise results will continue to use a stacked column chart.
  • Estimated results will be clearly labeled and will indicate the degree of precision.
  • Pattern analysis also works quickly over large-scales.
  • Events retrieval has been tuned to be 10x more efficient for massive-scale queries.
  • Histogram better displays very large numbers (for results with billions of hits).
• Filtering by Sources Feature:
  • Easily filter by one or more log sources using the new sources drop-down filter (next to org drop-down filter).
  • View the top 50k log sources over the time period (sorted by most common first).

Application v2024-12-21w - Lagging Data Sources & Deduplication

Features:

• Track lagging data sources and display ingestion health on dashboard.
  • Provide ability to copy detailed report to get list of lagging data sources.
• Deduplicate ingestion payloads larger than 16 KB (from same agent/IP).
  • Data sources that send duplicate packets will be marked as a lagging source for 30 minutes.
  • Data sources that send log events whose timestamps are older than 70 minutes will be marked as lagging for 30 minutes.

Application v2024-12-19w

Maintenance & Improvements:

• Logout loop solved if multiple browser tabs open
• Date/time picker implemented (known issue: time picker only works with touchscreen)
• Download context menu will warn if query parameters have changed since last search
• Search will automatically trigger if org selection changes

Application v2024-12-07 - Download Query Results

Features:

• Download query results as text, LQL, CSV, or NDJSON:
  • Download up to the first 1 million matching events for the current query.
  • Even large exports take less than 30 seconds to generate and download in compressed zip format.
  • Download links contain an embedded auth token and can be shared with others for up to 48 hours for easy collaboration outside your organization.

Application v2024-11-23s

Maintenance & Improvements:

• Fixed text wrapping so long JSON would not have cut off text.
• Implemented optimizations so vertical scrolling is faster for large result sets. Text selection in the main grid is off by default but can be enabled with a toggle button.
• Implemented a copy-to-clipboard button in the log context pane.