Release Notes

This page documents the latest changes and updates to SparkLogs. The application automatically updates to the latest version and cannot be downgraded. Backwards compatibility is a fundamental design principle to ensure that observability pipelines are not disrupted. Upgrades will not require changes to any ingestion pipeline or configuration.

SparkLogs Agent 1.10.0 - 1.11.3 (2026-09-22) - Device Health Monitoring

Features:

• Device health is scored. The agent watches disks, volumes, services, processes, memory, CPU, VSS, Windows Update and its own health, and raises a named condition when a state holds long enough to matter (a volume filling, an automatic service that stays down, a stuck service start, a shadow copy store near its cap). Each condition opens, escalates, recovers and closes as one episode, so a two-hour outage reads as one item with a start and an end. See Health topics.
• Device state message lines say what changed. Inventory and change events carry a meaning-rich one-line summary: 2 automatic; 1 running, 1 expected stopped. or 2 changed, 1 started, 1 exited; "+svchost.exe" "-backup.exe". Inventory data rows are ordered by what matters first (the fullest volume, the longest-stopped service, the heaviest process).
• New health topics. Storage devices and the volume-to-disk map, drivers, installed products with change signals, Windows Update state, feed health and collector health.
• Recognized workloads. The agent automatically identifies and records workloads (SQL Server, domain controller, DNS server, Hyper-V), customizing monitoring thresholds to ensure prompt response for key workloads.
• Pack pipelines. Data feed packs can now merge multi-part events, collapse repeats into a receipt with a count, and route events before shaping. Data Feed Pack 1.6.0 uses this for PowerShell script blocks.

Maintenance & Improvements:

• Only ordinary disks are measured. Optical, network and removable-media volumes keep an inventory row carrying their drive type and are never space-probed or graded.
• Agent memory usage is reduced and Windows event log subscriptions are faster and lower overhead.
• The agent is faster and more efficient in monitoring service health.
• Feed health properly considers disabled channel states. A collector outage shorter than the feed's tolerance leaves the verdict to the feed's other channels. Feed status now includes failure details at the individual channel level.
• Logging for temporary transport issues or event log subscription issues are less noisy.
• A device that is still onboarding no longer flips between onboarding states across heartbeats.
• Requires Data Feed Pack 1.6.0 or later for the PowerShell feed; older packs continue to work.

Data Feed Pack 1.6.0 - 1.6.4 (2026-09-22) - PowerShell Script Blocks, Config Changes, Storage Decodes

Requires SparkLogs Agent 1.11.2 or later.

Features:

• PowerShell script blocks arrive whole, once. Multi-part 4104 records are merged into one event per script, and a script seen again within 14 days on the same host ships as a short receipt with a count instead of the full text. The first copy carries the full script up to 256 KB. The message line names what the block does: destructive script block by "CORP\jsmith" pid 4412; ... calls "Remove-Item" ...; targets path_written "C:\ProgramData\stage\p.bin". Framework code Windows compiles on its own behalf is recognized and shipped without a body. See PowerShell feed.
• Configuration changes have one shape. Every change row states the kind of object that changed (a Windows service, a group, an audit subcategory, a scheduled task, ...), the action, and the object's identity, so two installs of different services are two rows and the same service twice is one row with a count. Security principals acted on are named separately and only when the event carried one.
• Storage decodes reach Storport and StorDiag. A StorDiag 504 event decodes its IOCTL control code and its NTSTATUS to readable names. Storport entries that carry expected sense data, a drive reporting a routine condition, no longer ship.
• Default-disabled channels are marked. Channels that Windows registers but ships switched off are marked in the pack, so the agent leaves them unbound and a feed's health does not wait on them.
• Workloads replace "systems". SQL Server, domain controller, DNS server and Hyper-V pages describe what a client runs and how it is recognized. See Workloads.
• Field reference for every topic and feed. Each device state topic page and feed page carries a field table: name, type, unit, what the field means, an example, and the agent version it first shipped in.
• Device state event examples. Device state condition and inventory pages document the message and fields in each kind of event. Reason pages document curated fault conditions: what they mean, what to do, and relevant Microsoft references.
• Known Windows services are classified. 73 built-in services (Print Spooler, Windows Update, DNS Client, Task Scheduler, Remote Desktop, ...) are associated with a diagnostic theme, making it easier to correlate events.

Maintenance & Improvements:

• Scheduled task registration events are kept. Only Group Policy's own registrations (event 140 raised by NETWORK SERVICE under Microsoft\Windows\GroupPolicy) are dropped.
• Quieter collector self-reporting: Event Log resume-ladder lines for a dead bookmark drop to debug, and the collector's own housekeeping lines no longer ship.
• A feed can declare how long one of its channels may sit unavailable before the feed reports itself blocked. Shipped feeds use the agent defaults: 5 minutes for a required channel, 4 hours for an optional one.
• The declared ingest flush interval is 60 seconds, matching the agent default.
• Public pages say "reason code", "Workloads", "live" and "planned"; a feed is either collected and curated or collected and searchable.
• The device state feed is sparklogs.device.state (was sparklogs.agent.state); filter on subsource with the new id. Rows stored under the old id stay as history.
• Reference index rewritten as a concept page with an index per category.

Cloud Services v2026-09-22 - Table Queries and App Analytics

Features:

• MCP tools to list and query tables. This describes all available data sources (log and IT Fleet Intelligence data, App Analytics data), and provides a tool to query it. See Connect your AI.
• Filter data over any field. You can filter over any field in the schema, and for calculated tables with underlying tables, you can additionally filter the underlying data before the calculation is made.
• Time bucketing and aggregations. Group by a column or a time bucket, rank the groups, and aggregate with count, distinct, sum, average, min, max, and percentiles, including a filter on one aggregate so the same query can put totals next to errors, then keep only groups that meet a threshold.
• Calculated metrics. We also expose calculated metrics over base tables. For example, for App Analytics, 25+ metrics (DAU vs MAU, user retention, etc.) are provided. Results are cached and can be refined.
• Query for fleet-wide agent collection status. Allows you to check if data collection itself is fresh and healthy, which data feeds are stuck, and what to do about it.
• Explore App Analytics data with AI. With App Analytics enabled, ask daily active players, sessions, playtime, purchases, ads, and retention.

Maintenance & Improvements:

• The refine scope MCP tool was updated to search more broadly (better matching) and have a return shape that is easier to understand and use with other MCP tool calls. This results in a more precise scope, which leads to faster and more accurate query answers.

Application v2026-09-22s - Better Data Feed and Agent Status

Features:

• Data feed health displays channel-level detail. On a SparkLogs Agent that is not current, the data feeds section lists the individual Windows channels that are unhealthy and the Win32 errors causing the problem.

Maintenance & Improvements:

• A server that is health but offline is not marked as needing attention. Configure > Agents and the home dashboard no longer count a server that is offline but otherwise health as needing attention. It remains in the offline count and filter.

Cloud Services v2026-09-18 - MCP Across Device Health, Logs, and Analytics

Features:

• Three device-health views and better filtering. The default (omit view) is one row per episode: that episode's latest event. view=latest_state is one row per subject on the box (disk, service, process, software) containing just its latest state. view=timeline is every matching event in the window, oldest first. A severity floor on the default and latest_state views applies to that latest event. On timeline it applies to the peak in the window, then every in-window event of those episodes is included. This allows you to see all events connected to episodes that peaked above a given severity. See Health topics.
• Expanded query caching and refinement. Fleet listings, the field catalog, pattern stats, and device-health pages come back as a query ID that you can refine: page, filter, and aggregate. Improves token efficiency and allows agents to incrementally explore data.
• Rank items inside device state inventories. Services, processes, volumes, and similar lists can be grouped and ranked by an item in the list (a stopped automatic service, a filling volume) across the fleet. See Lightning Query Language.

Maintenance & Improvements:

• Device-health severity filters are now strings and accept the same names as LQL (warning, error, and the rest of the LQL severity vocabulary).

Cloud Services v2026-09-17 - Precise Field Catalog Counts

Features:

• Precise counts of custom fields. The field catalog (Explore UX and MCP list_fields tool) now reports how many events in the window included each custom field precisely. Previously, this information was estimated at the ingest-batch granularity.

Data Feed Pack 1.5.0 - 1.5.5 (2026-09-12) - Six Windows Event Feeds Curated

Features:

• Six Windows Event Log feeds move from collected to curated: storage, identity and security, management, apps, platform and network. 120 named conditions, each with a class, a tuned severity, what it means and what to do. Routine narration on these channels is capped low or dropped, so the data prioritizes faults, not Windows housekeeping.
• Storage conditions: Bad blocks are Serious on a fixed disk (SATA, SAS, NVMe, RAID) and Warning on removable media; a controller reset is Error only on the boot device; NVMe self-reported failure predictions ship as a condition. SCSI sense key, additional sense code and SRB status decode to readable names. Command failures on empty card readers and DVD drives are dropped.
• Identity and security conditions: Code Integrity block events requested signing level, BitLocker recovery key escrow failures (Error) and device encryption failures, Windows Hello provisioning, Group Policy processing and domain controller discovery, AppLocker audit hits, LAPS password backup, Microsoft Entra registration and token failures, and directional NTLM use.
• Management conditions. Scheduled task start, logon and load failures with the result code decoded; DFS Replication stopped (Serious) and SYSVOL initial sync pending; Hyper-V VM start, checkpoint and replication failures and corrupted VHD chains; printer driver install failures; MDM policy failures naming the CSP; Windows Update download and scan failures.
• Apps, platform and network conditions. Packaged-app deployment, provisioning and activation failures; Dell tamper indicators and firmware verification scans; slow boot and shutdown; devices that fail to start; SMB client and server failures with the status decoded, insecure guest and signing posture, DHCP lease failures and address conflicts, DNS resolution timeouts, wireless connect and handshake failures, Offline Files sync.
• Normalized storage of Windows status codes. A status word on any curated event resolves to sparklogs.result.code, code_space and code_name (NTSTATUS, HRESULT, Win32, SSPI, CryptoAPI, LDAP and Entra token broker spaces), so one LQL filter matches a failure code consistently.
• Improved message formatting. A Windows event whose provider is not registered now renders as message text naming the provider, event id and channel, so patterns group properly; other event fields are still preserved in the payload.
• Conditions link across feeds. A fault reported by two feeds (a bad block seen by System and by Storage) links to its sibling on the reference pages. 17 network conditions carry "what to do" lines and references sourced to Microsoft documentation.

Maintenance & Improvements:

• Reduced noise from events: per-load Code Integrity traces, BITS transfer lifecycle, SMB transport selection, Server Manager refresh, WMI query narration, scheduled task run history and Volume Shadow Copy teardown no longer ship. NTFS and StorPort hourly latency summaries ship only when a slow-IO counter is non-zero.
• Known-benign Windows warnings stop reading as errors: peer-helper initialization on servers, ETW session name collisions, packaged apps refusing to run as the built-in Administrator, redirected printer configuration, device metadata lookups, Windows Update service-start status checks.
• Microsoft account and Entra token traces keep resource, timing and status and drop any token material.

Cloud Services v2026-09-08 - MCP Query Enhancements, Feedback Feature

Features:

• Send feedback using MCP. Securely send a note to SparkLogs support in your AI session, letting us know what needs to be improved, or with bug reports or product ideas.
• AI sessions get more done in fewer steps. We rebuilt MCP tool responses to focus attention properly and reduce agent confusion (especially weaker models). The higher-level query tools can now surface IT issues earlier and with fewer tokens.
• Ask about the fleet as a whole. Group and rank any events by any field or combination of fields (source and application, reason and device). Bucket trends by time or other dimensions.
• Configuration changes. Ask what changed on one machine or your whole fleet and get aggregate and individual details: what object was touched, what was done, who did it, and when. For example: service installs, group membership changes, audit policy changes and scheduled task creation.
• Refine enhancements. The refine tool has now capabilities to group, filter, and aggregate previously cached queries. This allows the initial query to return a smaller, more focused, token-efficient response, while allowing quick, precise follow-ups by AI agents.
• Aggregate math over device measurements. Average, minimum, maximum, standard deviation and exact percentiles over any numeric reading the agent reports, per device, across the fleet. Ask "which machines run hottest CPU at the 90th percentile this week" and get a ranked answer.
• Search inside inventories. Device inventories arrive as lists (every service on a machine, every process, every volume). AI agents can now filter matching items out of the list as part of the query, such as "the services set to start automatically that are not running", so responses are kept token-efficient. See Lightning Query Language.

Maintenance & Improvements:

• MCP tool descriptions were optimized to reduce inaccurate tool usage and improve AI client comprehension.
• When a query returns nothing, the response provides relevant hints for common mistakes (a misplaced quote, a filter that reached the wrong layer).
• More token-efficient response format: dense-tables (TSV) or JSONL is selected automatically to minimize output size without losing meaning.
• Any technical difficulties return a short incident id you can include in a support/feedback request when asking for help.

SparkLogs AI Plugin 1.6.0 (2026-09-08) - Feedback Skill, Device Health Playbooks

Features:

• Send feedback without leaving the session. The sparklogs-feedback skill securely sends your feedback to SparkLogs support. Help us improve, and send us your product ideas and bug reports.
• Device health playbooks: how to find unhealthy devices, stopped automatic services, process and service inventory, configuration changes, and numeric measurements per device (average and percentile).
• Configuration change guidance. What a config change row contains (object kind, action, identity, actor, principal acted on) and how to effectively query for it.

Maintenance & Improvements:

• More concise language: edited for brevity; removed MCP tool mechanics from plugin (replaced by MCP server tool descriptions)
• One vocabulary throughout: field name, column, row, response. Reference pages regenerated from Data Feed Pack 1.5.4, including the six themed Windows Event Log feeds.
• Plugin packaging fixed for Claude Desktop: Claude Desktop now includes all reference materials (Claude Code was unaffected).

Data Feed Pack 1.4.0 (2026-09-02) - Comprehensive Windows Event Feeds

Features:

• Five new Windows Event Log feeds (platform, storage, network, identity and security, management, apps) with basic curation: covers 100+ additional channels.
• Reference pages for every feed, code table and health topic are generated from the pack.
• Shared service table classifies vendor and product services (backup, EDR, RMM, database, mail, directory).
• Better decoding for Windows servicing errors.

Cloud Services v2026-09-02 - Ingest Credential Redaction

Features:

• Credential-shaped text is now redacted for all cloud-ingested events by default. Passwords in connection strings and key=value pairs, command-line password flags, PowerShell secure-string and credential constructors, encoded commands, URL userinfo, and bearer/vendor tokens are replaced with <redacted> before storage, including in nested fields and arrays. Set the X-Redact-Mode header to off to disable. Events with any change are marked __redacted; find them with the LQL expression __redacted!. See HTTPS JSON.

Data Feed Pack 1.3.0 (2026-08-31) - Curation of Windows Event Log (Application, System, Security)

Features:

• Less noise, clearer incidents across Application, System, and Security. Windows events are classified into named conditions with severity tuned for MSP triage, not Windows defaults. Routine servicing chatter, benign Volume Shadow Copy shapes, WMI registration notices, and similar high-volume lines stop crowding error views and AI summaries.
• Security and identity questions get direct answers. Account lockouts, Kerberos and TLS failures, SMB and NTFS access problems, MFA gaps that still allow logon, and endpoint isolation from your EDR show up as distinct conditions instead of opaque Event IDs. See IT Fleet Intelligence.
• Patch, install, and component-store failures name the problem. Failed updates, blocked servicing, and corrupted stores are separate actionable conditions. Hex status codes in messages decode to readable Windows error names where SparkLogs holds a mapping, so tickets and chat answers spend less time translating codes.
• Backup and VSS problems separated from benign events. Writer failures, provider registration gaps, and shadow-storage exhaustion are elevated; known-benign VSS activity during shutdown or optimization stays quiet.
• "What ran on this box?" with redacted command lines. Process command lines from Windows events are available for investigations and AI follow-ups; credential-shaped values in those lines are stripped before data leaves the endpoint.

Maintenance & Improvements:

• Group Policy drive-map and preference failures distinguish unreachable shares, bad credentials, and letter conflicts.
• Application stability covers crashes, hangs, and common server workloads (ASP.NET, SQL-adjacent faults, unhandled .NET exceptions).
• Broader coverage for Entra sync, certificate enrollment, VPN dial failures, and endpoint protection agent status.

SparkLogs AI Plugin 1.5.0 (2026-08-31) - OAuth Sign-In and More Accurate Investigations

Features:

• OAuth is the recommended auth for the bundled MCP connection. Sign in to SparkLogs in the browser when the host prompts. An API token remains available for headless or automation hosts that cannot open a browser. See Connect your AI.
• Investigations check coverage first: is this client or host in SparkLogs, and did events arrive, before treating silence as healthy. That avoids wasted log searches and wrong "nothing happened" answers.
• Device questions go to standing state (CPU, disk, software, services) when SparkLogs Agents are in scope. Ingest-key-only streams skip that path.
• Volume Shadow Copy (VSS) playbook for snapshot and writer problems, kept separate from backup job failure.
• Claude Team and Enterprise org-wide install is documented separately from personal Claude Code and Desktop. See Claude organization-wide deployment.
• Microsoft Copilot Studio connects over MCP with the agent instruction template. See Copilot Studio.

Maintenance & Improvements:

• Plugin ergonomics improved. Ask, investigate, and analyze-cause are skills: plain language is enough. The slash commands that remain are sparklogs-explain and sparklogs-summary. On Claude Code they appear as /sparklogs:sparklogs-explain and /sparklogs:sparklogs-summary. Update saved prompts that still called /sparklogs:ask or /sparklogs:investigate.
• Empty sparklogs.* fields on an event mean the event is uncurated. That is not a health finding. unknown on a feed is not "the device is unhealthy."
• Cause analysis stays a separate, labeled step. The default write-up is a cited system-condition summary, including what was not checked.
• More Application, System, Security, servicing, and Defender field and reason coverage from the current Data Feed Pack.
• Symptom playbooks are shorter. Guides for each kind of stream (Security vs Setup vs Defender vs device state vs file logs) so the right source is queried first.
• Pattern grouping still holds when the same kind of event has slightly different message text.
• A Windows application-name list so "what is installed" questions resolve to the product you mean.
• Query recipes can match items inside lists (nested Windows event fields).

Cloud Services v2026-08-31 - LQL Query Arrays of Objects; Pipeline Resiliency

Features:

• Query arrays of objects in LQL: path[](expr) matches when at least one element satisfies expr, and path[]! matches when the array is present. For example, find hosts whose services inventory includes the print spooler:

  sparklogs.kind=inventory sparklogs.topic=services sparklogs.data.services[](name="Spooler")

  See Lightning Query Language.

Maintenance & Improvements:

• Ingestion and query pipeline resiliency for better performance and reliability. Improved algorithms for flow control and reliability even under degraded or unexpected cloud conditions.
• Allow certain metadata updates to ingest keys and app registrations in all states (e.g., after revocation).

Application v2026-08-29v - UX Performance and Reliability

Maintenance & Improvements:

• UX Performance: minimized state and component rebuilds across the entire app, resulting in a snappier UX.
• Returning to the browser tab no longer interrupts page state: on tab reactivation open dialogs will stay open even when most workspace metadata changes. The Explore Data page will not rerun a query and interrupt your current diagnosis flow.
• Better error handling and API resiliency especially if the UX tab is left in an idle state for hours or days.
• Polished Workspace Access pages: better indicators for certain credential states, better filter state after credential creation, better progress indicators.
• Updated OAuth consent reconnection behavior: You can now immediately approve, review, or cancel, without waiting a few seconds. See Connect your AI.

Cloud Services v2026-08-26 - AI Connector Compatibility and Event Pattern Refinements

Maintenance & Improvements:

• AI connector compatibility: sign-in completes when the OAuth client omits scopes or sends extra names. Unknown names are dropped; recognized SparkLogs scopes are granted. A client that names none gets the default query scopes on the consent screen. See Connect your AI.
• Connectors can revoke their OAuth tokens when they disconnect, so a removed AI client does not leave a live refresh token.
• AutoExtract patterns group more tightly: Windows drive letters stay paths, hex runs collapse, and version numbers sort before dates.
• MCP pattern tools clarify the shown pattern text is a sample. Filter and join on pattern_hash.

SparkLogs Agent 1.9.10 (2026-08-26) - Auto-Update Resiliency

Features:

• Update checks survive daily reboots and sleep. The next check time is remembered across service restarts, so workday endpoints that power off overnight still reach a published build instead of starting a fresh 10-14 hour wait every morning. See How automatic updates work.
• Retries in the same wake window when a check hits a network that is not up yet (boot or resume from sleep), instead of waiting another full interval.
• Restores a missing Windows Installer cache for this agent's own package, so auto-update, repair, and uninstall keep working when that cached file is gone.
• Clearer auto-update status on the device. Configure > Agents shows when the last update check completed, and distinguishes an installer-cache problem from a failed installer run.

Maintenance & Improvements:

• An in-flight update is not reported as idle while the installer is still running.
• An already-downloaded update package is reused when the same version is still staged.

Data Feed Pack 1.2.8 (2026-08-21) - Windows Servicing Curation

Features:

• Windows servicing feeds (CBS/DISM) are now curated to actionable conditions and key events.
• Real component-store problems are reported as their own conditions, including corruption Windows detects, corruption it repairs, repairs that could not complete, and updates blocked by a damaged store.

Maintenance & Improvements:

• Several families Windows itself logs as errors are curated to reflect proper severity, including Volume Shadow Copy driver-enumeration messages during backups, WMI provider registration notices, drive optimization on virtual disks, and file-hash mismatches for content updated outside the servicing stack.

SparkLogs Agent 1.9.9 (2026-08-19) - Uninstall Status Visibility

Maintenance & Improvements:

• Clearer device status after a cloud-requested uninstall: the device shows as uninstalled when the agent software actually comes off the endpoint, and a removal that could not complete stays visible and retries instead of going quiet.

SparkLogs Agent 1.9.8 (2026-08-18) - Remote Deletion Lifecycle

Features:

• Deleted devices go quiet remotely. When you delete a device in the app, its agent stops collecting and idles, with no site visit. Undelete the device and it resumes on its own.
• Optional remote uninstall. A delete can carry an instruction for the endpoint: leave the agent idle, uninstall it, or uninstall and remove local agent state. The agent confirms the instruction twice before acting. See Delete and remote uninstall.
• Self-healing enrollment. An agent whose credential was superseded re-enrolls automatically with its original registration token instead of going silent.

Maintenance & Improvements:

• A refused enrollment (for a deleted device) states the reason and the device in both the agent log and the Windows Event Log, so a technician can resolve it without a support ticket.

Cloud Services v2026-08-18 - Device Ownership Moves and Sticky Deletion

Features:

• Move a device to another organization. Identity, collection state, and future data follow the device; data already collected stays with the organization that owned it at the time. Moves stick through wipes and reinstalls. See Moving devices and organizations.
• Move an organization under a different parent. Everything below it comes along, and access and history follow the new position immediately.
• Deletion sticks. A deleted device stays deleted through wipes, reinstalls, and disk-restore cycles; undelete is the way back. One delete covers one machine however many times it comes back.
• Any registration token in your workspace reconnects a device to its existing record, whichever token its deployment package carries.

Maintenance & Improvements:

• Simultaneous first enrollments of one machine can no longer create duplicate devices.
• An install never fails because the identity a machine reports is stale; the device receives a fresh identity and keeps working.
• Ownership and deletion changes propagate to running agents reliably, without waiting on caches.
• Compatibility with more MCP clients that probe optional server features.

Application v2026-08-18u - Device Ownership and Fleet Cleanup

Features:

• Change ownership moves a selected device to another organization from Configure > Agents. Deleted devices can be moved too, so a record can be tidied into the right organization before undelete. See Moving devices and organizations.
• Change parent moves an organization, with everything under it, to a new position in your org tree.
• Delete with an endpoint instruction. Deleting an agent can tell the endpoint what to do with itself: leave the agent idle, uninstall, or uninstall and remove local state.
• Filter the agents list by text. Type terms to match against everything shown on the rows; combines with the existing health chips.

Maintenance & Improvements:

• Clearer wording when a move succeeds but cached authorization is still expiring.

SparkLogs AI Plugin 1.4.2 (2026-08-18) - Loads Cleanly on Claude, Codex, and Cursor

Features:

• /sparklogs:analyze-cause is now a slash command on Claude, matching the documentation.
• Codex marketplace install. Add the repository as a Codex plugin marketplace and install; the SparkLogs MCP server comes bundled and authenticates with your API token.
• Claude Desktop install via Directory > Plugins > Add marketplace, with automatic plugin updates.

Maintenance & Improvements:

• The MCP server connects reliably on every supported host.
• Claude command names simplified: /sparklogs:ask, /sparklogs:investigate, /sparklogs:summary, /sparklogs:explain. Update saved prompts that used the older doubled form.
• Reference guides and playbooks cited by the skills now resolve on every host.
• Install guides rewritten per host, including token setup.

SparkLogs Agent 1.9.7 (2026-08-17) - Stable Device Names and Identity Resilience

Features:

• Stable device names on domain-joined endpoints. The reported name is composed from the machine's own name and its directory domain, so it no longer flaps when a VPN connection changes the connection-specific DNS suffix. Applies to Active Directory and Entra joined machines.
• Keeps its identity across reinstalls, wipes, and image restores. After a purge, a rebuild from an image, or a nightly disk-restore cycle, the endpoint returns to the device record it already owns instead of arriving as a new one. See Agent identity and cloning.
• Takes its own identity when a cloned installation is detected, so machines deployed from one image end up as separate devices without a technician visit.
• Resumes collection where the endpoint left off. After a reinstall or restore, telemetry data already uploaded is not sent again.

Maintenance & Improvements:

• Update checks are spread across the fleet by release ring (faster updates for certain rings).
• Check-ins pause while an update installer is running.

Cloud Services v2026-08-17 - Agent Identity Resilience

Features:

• One identity per device, across the machine lifecycle. A device keeps its record and its history through agent reinstalls, reimaging from a captured image, and daily disk-restore tools such as Deep Freeze. Repeated restore cycles do not add duplicate devices. See Agent identity and cloning.
• Cloned installations are detected and separated automatically. When one image is deployed to several machines without preparation, each machine receives its own device record within a short period, and the original keeps its history. Preparing the image is still cleaner: see Prepare a golden image.
• Ingest resumes instead of restarting. An endpoint that re-enrolls after a reinstall or restore does not re-upload log data it already sent, so a fleet of frozen machines does not re-ingest the same history on every thaw.

Maintenance & Improvements:

• More reliable request handling under client disconnects and retries.

SparkLogs AI Plugin 1.4.0 (2026-08-17) - Chat-First Answers and Symptom Playbooks

Features:

• /sparklogs-ask answers a question about a host or a fleet in ordinary chat, with cited queries and follow-ups, and no report template. /sparklogs-investigate stays the written pass when you want the artifact for a ticket. See Chat with your data.
• Ten symptom playbooks as query recipes: backup job failure, BitLocker recovery, certificate expiry, directory replication, disk full or filling, memory or handle leak, RAID or array degraded, RMM connectivity, slow logon, and Windows Update failure.
• Topic guides route a question to the right data first: device health and state, endpoint protection, Windows operational events, Windows security and audit, and Windows updates and patching.
• Reference sets for every collected data feed, covering the fields that exist at rest, the values you can group by, what each event reason means, expected patterns, worked query recipes, and ECS and OCSF anchors.
• Device questions start with device state. "What is on the box", installed backup products, CPU, memory, and disk go to device health first rather than a log search.

Maintenance & Improvements:

• Investigation and cause-analysis skills follow the current MCP tool surface.

Application v2026-08-15m - Update Notification and Info Bar Refresh

Features:

• A banner appears when a newer version of the app is available. Choose Reload to pick it up right away, or Later to keep working and reload on your own schedule.

Maintenance & Improvements:

• Refreshed info bar styling across the app, with consistent notice colors in light and dark themes.
• Sign-in waits until your profile has loaded, so the first page after login is the one you expect.

Application v2026-08-14j - Agent Fleet Health and Triage

Features:

• See agent health at a glance on Configure > Agents. Each row shows device type (workstation, server, or ingest key), connectivity, and collection status in one badge. Filter the list with chips for All, Needs attention, Offline, and Inactive (long-silent endpoints), and sort by health, name, or last check-in. See Manage and verify agents.
• Rebuilt agent detail pane with expandable Properties, System Details, and Data feeds sections. Status pills match the list; a plain-language line explains why an agent needs attention. Per-feed collection health, auto-update status, skipped-events notices, and matched-file counts on file sources help you decide what needs human attention.
• Host facts in the UI: friendly Windows version names, device class, domain-controller role when reported, and service state when the agent announces stopped, shutdown, uninstalled, or an in-progress upgrade.
• Home dashboard fleet summary aligned with the Agents list. Notices for agents needing attention or offline are links: they open Configure > Agents with the matching filter, sub-orgs included, and the org tree moved to a root that actually has matching endpoints.

Maintenance & Improvements:

• Include sub-orgs is on by default when browsing agents, so MSP fleets see client endpoints without an extra toggle.
• Clearer agent and feed vocabulary across the list, detail pane, and dashboard (consistent "data feed" wording and filter tooltips).
• Clearer troubleshooting when a data feed pack is still downloading (wait-time guidance and outbound HTTPS checks).
• Agents layout polish: wider list column on wide screens, improved detail-pane scrolling, and muted device icons when an endpoint is offline.
• Workspace API tokens: grantable MCP scopes are selected by default when you mint a new token. See Access.

Cloud Services v2026-08-14 - MCP for AI Assistants

Features:

• MCP for AI assistants. Connect Claude, Cursor, Codex, or your own MCP client to SparkLogs and query telemetry in the authenticated workspace. Sign in with a workspace API token or OAuth under Workspace Settings > Access. Simple questions can be answered in ordinary chat; a full investigation is optional. See IT Fleet Intelligence and Connect your AI.
• Investigate with LQL: search events, page or refine a result, and list sources and scope for a client or endpoint.
• Pattern and health tools: pattern stats with optional examples, event counts by severity, and device health for SparkLogs Agents (including silent devices).
• See the live demo.

Maintenance & Improvements:

• Sampled aggregates are labeled so a partial count is not presented as complete.
• Results stay inside the authenticated workspace and organization scope.

SparkLogs AI Plugin 1.3.0 (2026-08-14) - Investigation Workflow

Features:

• SparkLogs AI plugin for Claude Code, Cursor, and Codex. Install from the SparkLogs AI Plugins marketplace (itlightning/sparklogs-ai-plugins), then connect with OAuth or a workspace API token. Chat with your data and follow up as far as the issue goes; run /sparklogs-investigate when you want the written report.
• /sparklogs-investigate gathers evidence and writes a cited system-condition summary (agentic RCA).
• /sparklogs-analyze-cause is an explicit second step: candidate hypotheses with confirm/refute checks, labeled as analysis rather than fact.
• /sparklogs-summary and /sparklogs-explain re-render a summary for tickets or walk a specific claim back to evidence.
• Windows Security investigation playbooks follow the current MCP discovery and pattern tools.

SparkLogs Agent 1.9.6 (2026-08-14) - Comprehensive Collection Health Reporting

Features:

• Waits until collection is measured before reporting health. After reboot or sleep, Configure > Agents no longer flash an unknown or needs-attention state while feeds are still starting.
• Proper status reporting on filtered Windows event log channels.
• Empty file logs count as healthy. A CBS/DISM-style feed with no files yet is current, not stuck.
• Clearer Event Log task names on collected events.

Maintenance & Improvements:

• Heartbeats include the collector's own feed, or report when that feed is missing.

Data Feed Pack 1.2.7 (2026-08-13) - Security Channel Curation

Features:

• Kept directory object access (4662) is classified by meaning: Notable for real access-check shapes, Warning for replication-access shapes.
• Blocked Filtering Platform connections (5157) stay at Verbose.

Maintenance & Improvements:

• Long security payloads are trimmed at a declared bound.
• CBS/DISM servicing poll-narration tail is omitted.

Data Feed Pack 1.2.6 (2026-08-13) - Security Channel Curation

Features:

• Security collection omits families Microsoft and common SIEM filters treat as non-signal, including filter-engine churn (5447, 5449), handle close/duplicate (4658, 4690), bind records (5158), and IPsec 4985. These events remain in the endpoint Event Log.
• Audit-useful shapes in these families are kept, including sensitive privilege use (4703, 4673) and failed or replication-related directory access (4662). This keep-set is wider than typical default SIEM filters.

Maintenance & Improvements:

• CBS/DISM session-start banners are omitted.

SparkLogs Agent 1.9.5 (2026-08-12) - Accurate File-feed Health

Features:

• File log feeds report real catch-up. CBS/DISM-class sources freshness is reported accurately in all cases.

Maintenance & Improvements:

• Additional pipeline drain resiliency during collector service stop.

SparkLogs Agent 1.9.4 (2026-08-11) - Stop Reason and Quieter Endpoints

Features:

• Reports why the Windows service stopped (stop, shutdown, uninstall, or upgrade). Configure > Agents shows that reason instead of a silent offline.

Maintenance & Improvements:

• At least 20% lower memory usage on typical endpoints.
• Clearer agent logs when cloud API calls fail.

Data Feed Pack 1.2.5 (2026-08-11) - Stable Feed ID

Features:

• Each data feed carries sparklogs.feed.id, a stable identifier independent of display name.

Data Feed Pack 1.2.4 (2026-08-11) - Security Channel Curation

Features:

• Security account-lifecycle family is split.
• Eventlog 1100 (logging stopped), 1101 (transport discarded audit records), and domain policy change 4739 are classified.

SparkLogs Agent 1.9.2 (2026-08-10) - Device Class and Skipped Event Reporting

Features:

• Reports workstation vs server, and domain-controller role when present, for the fleet health UI on Configure > Agents.
• Reports skipped-event spans when Windows Event Log can detect collection skips. Shown as skipped events in the agent detail pane.

SparkLogs Agent 1.9.0 (2026-08-09) - Per-source Collection Health

Features:

• Per-source collection health on each check-in (quiet and caught up vs behind or stuck), including Event Log channel status.

Maintenance & Improvements:

• More resilient drain of all pending events in flight during a service stop.
• The collector config check is cancelled promptly when Windows asks the agent service to stop.

Data Feed Pack 1.2.3 (2026-08-09) - Security Decode Fixes

Features:

• Clock-change events (4616) use the values Windows actually wrote.
• PowerShell Direct handshake 4625 is not treated as a real logon failure.

Maintenance & Improvements:

• CBS session preamble is out of the Verbose band.

SparkLogs Agent 1.8.1 (2026-08-08) - Event Log Recovery

Features:

• Windows Event Log collection recovers from a dead subscription. If the underlying Windows Event log channel subscription gets stuck and stops delivering events, automatically self-heal and restart collection with a new subscription exactly where we left off.

Maintenance & Improvements:

• Substantially faster collector startup after a restart.

Cloud Services v2026-08-07 - Bidirectional Control Character Stripping

Features:

• Unicode bidirectional control characters are stripped at ingest from every string value before field extraction and pattern analysis. Stored text, patterns, and searches match what you see on screen, and a common text-spoofing vector is removed; no letters are ever removed. Set X-No-Strip-Bidi-Controls: true (or no_strip_bidi_controls=true) on HTTPS+JSON requests when you need exact mixed right-to-left and left-to-right display fidelity. See ingest control fields.

SparkLogs Agent 1.7.9 (2026-08-06) - Safer Updates and Permissions

Maintenance & Improvements:

• Automatic updates refuse a replacement binary that has no version, as a defense-in-depth to preserve working installs.
• The agent repairs and strengthens its working-directory permissions automatically.

SparkLogs Agent 1.7.8 (2026-08-06) - Cleaner Upgrades on Disk

Maintenance & Improvements:

• Uninstall and upgrade more thoroughly remove leftover collector cache and state.
• Data feed pack apply spends less CPU during service start, so data starts flowing faster.

Data Feed Pack 1.2.2 (2026-08-06) - Enhanced Security Channel Curation

Features:

• Process create (4688), credential-manager reads, crypto ops, audit-log cleared / time change, and enumeration shapes (4798, 4799) are classified.
• Clearer event when a Windows Event Log channel is not collected.

Cloud Services v2026-08-05 - Enhanced Bare-term LQL Search

Features:

• A bare LQL term also matches subsource, service, category, span_id, and companion *_hash fields. Typing a subsource such as win.servicing.dism finds those events; previously only any: did. See Lightning Query Language.

Maintenance & Improvements:

• field! on empty standard columns has the same semantics as for custom fields (non-NULL and not empty) (for example trace_id!).

Application v2026-08-04o - Dashboard and Explore

Features:

• Home ingestion dashboard defaults to grouping by organization, so MSP workspaces see per-client volume without changing the control first.
• Explore severity histogram shows all seven standard severity levels in the chart grid.

Data Feed Pack 1.2.1 (2026-08-04) - Security Logons

Features:

• Failed logon and lockout cause is decoded from NTSTATUS (4625 and related).
• Kerberos and NTLM failures, including the RC4 service-ticket downgrade signal.
• Sign-in (4624), special privileges (4672), and group grant / membership use an account identity, not a person claim.

Maintenance & Improvements:

• CBS scan tally is split into separate facts.

Application v2026-07-29g - API Access, MCP oAuth Consent, and Ingest Policy

Features:

• Workspace Settings > Access: mint, rename, and revoke workspace API tokens with scoped permissions. Token revocation stops the token immediately and cannot be undone from this screen.
• OAuth consent for connected apps (including MCP integrations): approve requested scopes on a dedicated consent screen; list or disconnect apps that already have access.
• Ingest policy settings under Workspace settings, with defaults seeded by the setup wizard. Control workspace-level severity caps for uncurated ingestion; see HTTPS+JSON ingest.
• Explore updates: revised severity ladder presentation and an MSP-oriented context relax-ladder order. source_hash is available as a standard explore field alongside source for stable grouping.
• Organization editor: set RMM/PSA client IDs on an org with duplicate-ID warnings before you save.

Maintenance & Improvements:

• Setup wizard opens reliably when you create or switch into a workspace that still needs onboarding.
• Smoother workspace join and invitation flows, including a logout notice on the login page when your session ended.
• Permission, org-tree, and archiving fixes for edge cases during workspace lifecycle and role changes.

Cloud Services v2026-07-29 - Ingest Control Fields

Features:

• X-No-Extract-Fields: skip custom-field extraction from message text while still detecting category, severity, and timestamp. See HTTPS+JSON ingest.
• X-Drop-Older-Than-Secs: skip events older than the stated window; the HTTP request still succeeds.
• An empty category_override is authoritative: a blank override means no category. If the field is unset, then the automatic category detection is used.

Data Feed Pack 1.1.1 (2026-07-29) - Windows Event Log and Defender

Features:

• Classic Windows Event Log channels: Security, System, Application, and Setup.
• Microsoft Defender Operational (detections, protection off, definition and engine failures).
• The agent's own operational log (startup, ingest errors, spool) is queryable like any other data feed.
• Shaped events carry a consistent app grouping field.

Application v2026-07-22q - Setup Wizard Polish

Maintenance & Improvements:

• Setup wizard behaves correctly with existing organizations and tokens (recommended mode, no duplicate token or ingest-key creation, scaffold actions bound to the right org).
• Invitation emails are normalized to lowercase so invites match regardless of how the address was typed.
• Auth routing and Help Center fixes for workspace context and sign-in edge cases.

Cloud Services v2026-07-15 - Scope Discovery Archive Tables

Features:

• Hourly scope and pattern aggregate tables in the archived data lake. Archives can now include materialized-view summaries for scope ladder and per-pattern statistics (logs_scope_ladder, logs_patterns), with expanded logs_sources exports. Tables appear in your replicated bucket as your workspace is upgraded. See Archive Data Format.

Cloud Services v2026-07-10 - Companion Hash Fields

Features:

• Companion hash fields at ingest for key standard fields: pattern_hash, source_hash, subsource_hash, category_hash, service_hash, and app_hash. Each is a compact, stable identifier for its base value, computed in the cloud after normalization, so you can pin filters, group results, and hand a short token between tools without carrying the full text. See hash fields.

SparkLogs Agent 1.6.3 (2026-07-10) - Defender Channel and Upgrades

Features:

• Windows Defender Operational channel added to the standard Windows Event Log data feed pack, so Defender operational events are collected with the rest of the endpoint sources.
• Clearer first-hop identity on agent logs: host identity and locality are stamped on collected events, with observed_timestamp and related fields aligned for fleet-wide grouping. Normalized subsource values stay comparable across machines; see subsource normalization.

Maintenance & Improvements:

• More reliable Windows upgrades and uninstalls, including safer rollback and recovery if an update is interrupted.
• Data feed pack updates validate before they replace a good install; corrupt or unexpected packs are rejected without degrading collection.

SparkLogs Agent 1.6.2 (2026-07-02) - Windows Early Access

Features:

• The SparkLogs Agent for Windows, now in early access. A first-party, signed, self-updating endpoint agent that automatically discovers and collects operating system and application logs plus system health signals. No collector configs to write and no per-endpoint maintenance: install it and data flows. Supports Windows 10+ and Windows Server 2016+ (x64); macOS and Linux agents are on the roadmap; unofficial support for Win 8.1 and Server 2012 R2.
• Built for MSP fleets. Pass your RMM or PSA client ID at install time and every endpoint is automatically mapped to a per-client organization (created on first registration), so each client's data stays isolated and each client's fleet can be queried and managed on its own. See deployment scope.
• Hardened security. Outbound-only HTTPS, no inbound ports, no remote-execution capability, written in pure Rust, with two independent signature chains covering installs and automatic updates. See agent security and the Trust Center.

Data Feed Pack 1.0.0 (2026-07-02) - Windows Servicing Logs

Features:

• Windows CBS and DISM file logs. Component-store corruption, SFC/DISM repair, and servicing outcomes. Routine per-package census is omitted. Query at Info or above for investigation.

Application v2026-07-02 - Deploy Agents and Ingest Keys

Features:

• Deploy Agents wizard. A guided flow in Configure > Agents: choose your deployment scope, get a signature-verified download with its SHA-256, and copy ready-to-run commands for your RMM, Group Policy, Microsoft Intune, a single machine, or PowerShell. Roll the agent out across an entire client base in one afternoon. See deployment methods.
• Your whole fleet at a glance. The new Agents tab lists every SparkLogs Agent with version, OS, and last check-in, and tells you plainly when an agent is enrolled but not yet collecting. Clone detection flags credential reuse from cloned machine images.
• Registration tokens enroll agents into exactly the part of your organization tree you choose. Label them, set expirations, and revoke or restore them at any time.
• Configure is now Agents plus Ingest Keys. Managed endpoints live in the new Agents tab. The credentials formerly labeled "Agents" are now Ingest Keys (for collectors, SDKs, and APIs); they work exactly as before, and nothing changes for existing pipelines.
• New documentation: Deploy and Manage Agents, covering registration tokens, download and verification, every deployment method, ongoing management, and troubleshooting.

Maintenance & Improvements:

• Configure page layout improvements for narrow and stacked viewports.

Application v2026-06-25 - Workspace Setup Wizard and Guided Tours

Features:

• Workspace Setup Wizard. Tell us how you use SparkLogs (MSP / IT, Game / App Developer, SRE / Dev) and the wizard creates the recommended organization hierarchy and credentials for you. MSPs get an Internal IT plus Clients structure with registration tokens ready to deploy; developers get Dev, Staging, and Production with Ingest Keys. Review everything before it runs (nothing changes until you confirm), invite teammates along the way, and continue later at any point. You finish on a checklist of concrete next steps, like deploying the agent and confirming data in Explore.
• First-visit guided tours. Configure pages (Organizations, Agents, Ingest Keys, Archiving) and Explore now offer a quick tour that points out what matters on the page. Revisit any tour via the Help button ("Show tips for this page").

Website v2026-06-12 - Live Demo, Trust Center, Company Story and Leadership, and Search

Features:

• Live demo on the homepage: an interactive, ~3-minute replay of a real SparkLogs MCP investigation (query logs, check system state, trace root cause). Browse chapters, read the transcript, and see how SparkLogs delivers an AI-assisted troubleshooting workflow.
• Trust Center documents how SparkLogs protects your data in one place: Google Cloud infrastructure, encryption, data residency by region, tenant isolation, agent security, change control, availability, compliance posture, subprocessors, and responsible disclosure.
• Company page with our story, leadership team, and mission. Read how the product grew out of real MSP operations work and meet the people behind SparkLogs.
• Site-wide search now covers documentation and all other pages (pricing, use cases, company, Trust Center, and more). Find answers from any page via the header search bar or /search.

Maintenance & Improvements:

• Visual refresh: updated colors, typography, and section layout for clearer reading on desktop and mobile.
• Navigation updates: Trust Center and operational status are easier to reach from the header and footer; Company links are grouped in one dropdown.

Cloud Services v2026-06-01 - Dotted Field Normalization

Features:

• Flat JSON keys with dots are nested on ingest so stored custom fields match LQL path syntax; see dotted field names in JSON payloads (opt out via X-No-Normalize-Dotted-Field-Names).

Cloud Services v2026-05-26 - 3 New Regions: CA, AU, UK

Features:

• 3 new regions for Cloud Services: Canada, Australia, and UK.
  • Canada: ca (Montréal)
  • Australia: au (Sydney)
  • UK: uk (London)
• Regional pricing updated to reflect higher infrastructure costs in AU and UK.

Application v2026-05-26k - UX Polish

Maintenance & Improvements:

• Clearer warnings when permission caches cannot be refreshed. After successful changes to workspace user roles or organization/Ingest Key delete and restore, the app warns if cached permissions could not be cleared immediately so you know configuration data may be stale for a few minutes.
• Visual layout fixes for Ingest Key configuration text selection. Multi-line text selection within Ingest Key config templates now works correctly.
• More consistent app messages for success, failure, and warning messages (toasts, info bars, and dialogs).
• Workspace name in page and window titles on workspace-scoped pages.
• Home dashboard refreshes when workspace provisioning completes, so quota and ingestion widgets show the correct state without a manual reload.

Application v2026-05-22u - Unreal Engine Config Template

Features:

• Unreal Engine configuration template in Configure Ingest Keys. Copy-ready DefaultEngine.ini snippets for server, editor, and client launch configurations, with links to Unreal Engine ingestion docs.

Maintenance & Improvements:

• Smoother workspace switching on Explore, App Analytics, the home dashboard, and configuration pages. Spurious technical error notices during workspace changes are resolved.

Application v2026-05-21v - Private Cloud Archive Guidance

Maintenance & Improvements:

• More reliable workspace provisioning to avoid race conditions during certain UX conditions.
• **Improved guidance for private cloud archive bucket setup.

Application v2026-05-13t - Scope Pivots and OpenTelemetry

Features:

• Filter and explore by the new subsource and service standard fields. Use them in LQL queries, dashboards, and pinned filters the same way you use source and app.
• 5-level scope hierarchy in context exploration. The relax-ladder now walks subsource, source, service, app, organization_id, narrowing or widening the query scope one level at a time. Useful when drilling from a single pod's stdout up to "everything in this cluster".
• Ingest Key configuration templates now use native OTLP. New collector setups in the workspace ship with OpenTelemetry-compatible config out of the box.

Cloud Services v2026-05-13 - Expanded Source Coverage and Scope Pivots

Features:

• Two new standard fields for context exploration:
  • subsource: the most granular scope value (log filename, container stream, Windows Event Log channel, OTel instrumentation scope name, specific resource being acted on). Combines with source, service, app, and organization_id to form a 5-level scope hierarchy for context-aware exploration.
  • service: logical service or workload identity (e.g. OTel service.name, Kubernetes workload names, or the SaaS product name for connector-ingested data).
• Automatic pivot detection and standard field mapping for many more log sources. No per-source configuration required. New first-class support:
  • Agents and collectors: Vector kubernetes_logs, windows_event_log, journald, docker_logs, and file sources; Fluent Bit Kubernetes filter; Promtail / Grafana Alloy / Loki labels; Datadog Agent forwarded payloads; Splunk HTTP Event Collector.
  • Cloud services and serverless: AWS Lambda, AWS ECS / Fargate, GCP Cloud Run, GCP Cloud Audit Logs, Azure Functions, Azure App Service, Azure ContainerLogV2 (AKS), Azure Application Insights, Fly.io, Heroku Logplex.
  • See the full standard field mapping table for the exact pivots each source resolves.
• Smart collision handling. Senders whose field names overlap with SparkLogs's canonical fields are detected and remapped automatically. For example, Heroku's source field (which means "log producer", e.g. app / heroku-router) and Splunk HEC's source field (typically a file path) are routed to subsource, preserving the customer's original meaning while keeping source consistent with its system-wide definition.
• Severity-scale translation. Vendor-specific severity scales are translated to the standard OpenTelemetry 1–24 scale automatically:
  • systemd journald PRIORITY (syslog 0=emerg, 7=debug)
  • Azure Application Insights SeverityLevel (0=Verbose, 4=Critical)
• Composite source values. When a single field can't identify the producing instance, the composite is built automatically:
  • Kubernetes: <namespace>/<pod> from k8s.namespace.name + k8s.pod.name (or the Fluent Bit / Vector equivalents).
  • AWS service events: <account>/<region> for CloudTrail and GuardDuty findings.
  • Stripe events: live or test from the livemode flag.
  • Heroku: heroku/<source>/<dyno> from the renamed source field plus dyno.

Cloud Services v2026-05-08 - OTLP/HTTP Log Ingestion

Features:

• Native OpenTelemetry log ingestion via OTLP/HTTP: First-class support for the OpenTelemetry Collector (otlphttp exporter), every OTel SDK (Python, Node.js, Go, Java, .NET, Rust, …), Grafana Alloy, and any OTLP-compliant shipper.
  • Encodings: application/json and application/x-protobuf.
  • Compression: zstd, gzip, deflate, zlib, snappy, lz4, lz4-block, and identity.
  • Smart resource-attribute mapping: source, service, app, and subsource auto-derived from documented OpenTelemetry semantic conventions (service.name, service.namespace, k8s.cluster.name, k8s.namespace.name/k8s.pod.name, faas.instance, host.name, instrumentation scope.name, and many more). No custom mappings required.
  • Trace correlation: trace_id and span_id populated from OTel correlation context, so events from instrumented apps stay linked across services.
  • Built-in reliability: request deduplication, clock-drift correction, and defense against malformed and DoS payloads.

Application v2026-04-16 - App Analytics

Features:

• Game Engine Analytics is now App Analytics: the same session, retention, engagement, and monetization analytics, renamed for what it does: analytics for any application, not only games.
• The Overview dashboard now runs on your live workspace data, replacing the earlier preview experience.
• New Dashboards tab with built-in dashboards for common analytics questions.
• Chart property editor: choose the fields each tile displays, set number formats, and tune table options. New chart types include pie, donut, bar, and world map.
• Richer chart interactions: zoom and pan (Alt + scroll wheel), reset zoom, full-screen tiles, and optional data labels and markers.
• First-visit guided tour of the App Analytics Overview page.

Unreal Engine Plugin v1.0.10 [2026-04-13]

Maintenance & Improvements:

• Adopt new naming conventions from App Analytics name
• Include the ad action in the ad event ID hierarchy
• Minor fix to session duration validation logic when a session ends

Cloud Services v2026-02-06 - AutoExtract Root Field Customization

• The name of the root field that receives AutoExtracted data can now be customized (by default this is x).
• AutoExtracted fields can now be extracted into the root of the event instead of a nested field by setting the AutoExtract root field name parameter to $.

Application v2026-02-04k - Archiving and Replication

Features:

• Archiving and Replication: Replicate all your data to your own cloud storage bucket (AWS S3, GCS, Azure Blob Storage, or any S3-compatible storage) for compliance, disaster recovery, or geographic distribution.
  • Archived data is stored in a ready-to-query parquet hive-partitioned format.
  • Allows you to create a Data Lake of all your observability in a ready-to-query format from many popular Big Data platforms.
  • See Archive and Replication Overview for more details.
• Button on workspace settings page to allow self-service enablement of App Analytics feature

Cloud Services v2025-10-27 - Event Size Trimming

Features:

• Automatic event size trimming: Enforce limits on the size of each individual event: 512KiB for one log message and 3328KiB for custom field data in one event.
  • Individual events that exceed these limits will be automatically trimmed to fit within the allowed size.
  • Events that are trimmed in this way will have the custom __event_truncated_details field with details on what was trimmed. The LQL expression __event_truncated_details! can find all events that were trimmed.
  • This behavior can be customized through the X-Fail-When-Event-Too-Big header parameter.
• Increase max ingestion payload request size to 40 MB.

Maintenance & Improvements:

• Enhance supportability to diagnose failed authorization attempts and the associated workspace.

Cloud Services v2025-10-15 - App Analytics Snapshots

Features:

• Add automatic daily snapshots for app analytics data. Makes it easy to analyze long-term trends for DAU/MAU, retention, engagement, monetization, and more.
  • Snapshot cohorts can be segmented by user tags, install date, first purchase date, location, app version, and more.
  • Snapshots are retained for 7 years on paid plans.

Application v2025-10-13q - Download Org List

Features:

• Download organization list in CSV format.

Maintenance & Improvements:

• Improve display of lagging ingestion agents on dashboard.

Cloud Services v2025-10-08 - OpenTelemetry Collector Support

Features:

• Add support to ingest data from OpenTelemetry Collector. Detection is automatic. No configuration is required.
• Add search index support for integer and timestamp data types.

Maintenance & Improvements:

• Improve ingestion payload deduplication to dedup ingest payloads as small as 1KB.
• If there is no detected source field value for an event but the app field has a value, then also use the app field value for source.

Cloud Services v2025-09-23 - Materialized Views for App Analytics

Features:

• Add materialized views for app analytics data. Makes it easy and efficient to analyze analytics data and to analyze trends by analytics event ID.
  • Materialized views are always fresh and instantly up to date as new analytics data is ingested.

Unreal Engine Plugin v1.0.9 [2025-09-15]

Features:

• Dedup payloads across game engine crashes: enhances the plugin so that if a game engine process crashes after sending a payload and before it receives an acknowledgement of that payload, when the game engine restarts it will send the same payload again if possible.
  • It does this by remembering the size of the last payload as well as any common metadata used by the last game engine instance, allowing it to reconstruct an identical payload from the queue file.
  • This will allow the SparkLogs cloud to dedup such identical payload and prevent duplicate data from being received, even across game engine crashes/restarts.
• Persist any custom analytics user ID across game engine restarts

Maintenance & Improvements:

• Reduce client batch interval to 12 seconds (send analytics data faster).
• Use dedicated state INI file on desktop platforms (avoid rewriting larger user settings INI file now that we rewrite state more often).
• Synchronize any physical writes of the INI file to avoid racing on this.
• Fix unit tests randomly failing because of Unreal Engine caching old unit test state INI files.

Unreal Engine Plugin v1.0.8 [2025-08-29]

Maintenance & Improvements:

• Client build configurations will send queued data after 30 seconds.
• Adjust timeouts during shutdown so that at least 1 retry will happen no matter what.

Unreal Engine Plugin v1.0.7 [2025-08-26]

Features:

• Support multiple concurrent Unreal Engine game instances running at the same time for all types of data (including analytics data).

Maintenance & Improvements:

• Compatibility fixes for Unreal Engine 5.

Unreal Engine Plugin v1.0.6 [2025-08-25]

Features:

• Support multiple concurrent Unreal Engine game instances running at the same time (common in editor mode and QA environments) for log data data.

Maintenance & Improvements:

• The g_analytics.game_id field is renamed to g_analytics.app_id

Unreal Engine Plugin v1.0.5 [2025-08-19]

Features:

• Greater resiliency for progress markers: prevent duplicate analytics data from being sent when there is third-party interference clearing the queued data file on engine shutdown.

Maintenance & Improvements:

• Rotate the plugin ops log on startup if it's more than 5 MB (only affects servers).
• Log session ID in default message for session start/end.
• Only log value in default message if it's not null.
• Wait up to 15 seconds instead of 6 for final flush at end of game.

Unreal Engine Plugin v1.0.4 [2025-08-15]

Features:

• First purchased timestamp in analytics data: The purchase analytics event now includes a first_purchased field with the timestamp of the first time a purchase was made since the game was installed.

Unreal Engine Plugin v1.0.3 [2025-08-15] - Analytics User Tags

Features:

• User tags for analytics data: You can now set custom user tags to segment analytics data.
• Ad impression analytics events: The ad analytics event type was added to record analytics data for ad impressions.

Maintenance & Improvements:

• Purchase events properly record the transaction_num field value.

Unreal Engine Plugin v1.0.2 [2025-08-11] - Support UE5 & Linux

Features:

• Automatically adjust for inaccurate client clocks (uses the X-Client-Clock-Utc-Now ingestion request header).
• Add compatibility for Unreal Engine up through version 5.6.
• Add compatibility with Linux servers.
• Support ingestion session affinity for SparkLogs cloud (improves performance through better caching).

Maintenance & Improvements:

• Analytics sessions automatically start on servers as needed.
• Add plugin setting AnalyticsTargetCurrency to set the target currency for automatic currency conversion.
• Eliminate race condition during engine startup if plugin is manually initialized.
• Add FSparkLogsEngineOptions struct to group engine options together.

Cloud Services v2025-08-08 - Foreign Currency Conversion

Features:

• Automatic foreign currency conversion from over 200 currencies to a choice of 10 base currencies (e.g., USD, EUR, etc.).
  • Makes it easy to normalize financial data in log or app analytics data.
  • Currency conversion rates are automatically updated daily.

Cloud Services v2025-07-29 - GeoIP Lookups

Features:

• Automatic GeoIP lookup for all IPs detected in ingested data and for the client IP submitting the ingestion request.
  • GeoIP lookups are best effort and use publicly available information to estimate the country of origin for IP addresses.
  • The country of the IP address of the client submitting the ingestion request is stored in the client_ip_location field.
  • GeoIP lookups for all IP addresses detected by AutoExtract are stored in the x.ips_location[] string array field. You can use LQL queries like x.ips_location=US or x.ips_location=(US,CA,DE) to find events with IP addresses associated with certain countries.
  • GeoIP can be disabled by setting the X-Calc-GeoIP header parameter to false in ingestion requests.

Cloud Services v2025-07-23

Features:

• AutoExtract can now be disabled on a per-event basis by setting the __autoextract_disabled field to true in an event's metadata.
  • This is useful if you want to disable AutoExtract from extracting fields for only a subset of events in a particular ingestion payload.

Unreal Engine Plugin v1.0.1 [2025-07-04] - App Analytics

Features:

• Ability to capture and send App Analytics data:
  • Use the plugin to manage analytics sessions and capture design, progression, purchases, ads, resources, and error events.
  • Implements the standard Unreal Engine analytics interface so that existing analytics code works seamlessly.
  • Robust implementation captures analytics data even across game crashes, restarts, and periods when the machine is offline.
  • Supports both desktop, mobile, and server engine platforms.

Application v2025-50-20r - Improved Query UX

Maintenance & Improvements:

• Higher contrast and more compact log text display: remove horizontal gridlines, tighten spacing.
• Revamped event text rendering: 2x-3x faster scrolling through large result sets + smooth scrollbar scrolling.
• Load up to ~8000 matching events at a time (was 2000/query): helps you browse matching events faster and with fewer cloud queries. Browse up to 24000 matching events at a time.
• Fully precise text-wrapping: Fixes the display of very long events that wrap at odd points (e.g., large JSON objects).
• Better text selection support: Many text selection quirks were resolved. Text selection is now on by default in the matching event list.

Cloud Services v2025-04-24

Maintenance & Improvements:

• Optimize performance of full-text search index for certain international character encodings.

Cloud Services v2025-04-21 - Automatic Syslog Parsing

Features:

• Automatic Syslog Parsing:
  • Automatically parse (semi) compliant syslog formats including RFC3164 and RFC5424, as well as many proprietary formats including Cisco, Juniper, SonicWall, WatchGuard, and Fortinet.
  • This includes proprietary formats that use key-value pair values after a syslog header.

Maintenance & Improvements:

• Greatly improve recognition of edge case date/time formats, including odd ones that put the year after the time.
• AutoExtract recognizes MAC addresses for AutoClassify.

Cloud Services v2025-02-17 - Self-Hosted Querying Service Plan

Features:

• Launch Self-Hosted Querying service plan with even greater cost savings for large-scale environments.

Cloud Services v2025-01-28 - Quota Feature

Features:

• Quota feature that allows setting hard limits on data ingestion per workspace per calendar month.
  • When the quota is reached, further ingestion is blocked until the start of the next calendar month.
  • Useful to enforce maximum monthly spend as well as enforce limits on certain service plans.

Application v2025-01-20x - Billable Usage Reporting

Features:

• Adds billable usage reporting capabilities:
  • The ingested bytes chart on the dashboard lets you group by top agents or top organizations (defaults to by agent). The top 10 agents/organizations will be shown visually.
  • You can download a CSV report of all of the details behind the ingested bytes chart, which will have the details of all agents/organizations, not just the top 10.
  • On dashboard you can choose MTD, last month, or 2 months ago, etc., to help explore specific billable periods.

Maintenance & Improvements:

• The dashboard now displays agents that previously were actively ingesting data but have not ingested any data in the last 2 hours. These agents will continue to be considered as lagging for 7 days.
• The new agent / view agent API key dialog now displays template configurations for supported log forwarding tools & APIs.
• The agent details pane now displays the name of the organization that owns the agent.

Application v2025-01-09a

Maintenance & Improvements:

• Improve massive-scale adaptive query performance and accuracy:
  • Fixes histogram bucket behavior for adaptive-scale queries.
  • More accurate events search for estimated query results.
  • Clarify language when results are estimated that zooming in will add more precision.
• When toggling text selection preserve visible events.
• Fix scrolling in date/time picker using mouse wheel.
• Upgrade to Flutter 3.27 and reduce CPU/GPU overhead when app is idle.
• Copying a field or events as LQL will use equals operator for greater efficiency.

Application v2025-01-02w - Massive-Scale Adaptive Querying

Features:

• Massive-Scale Adaptive Querying Feature:
  • Quickly query any scale of data in seconds -- queries over large time scales (e.g., weeks/months/years) will now be very fast and show estimated results.
  • Estimated results will be shown on the histogram using a stacked area graph to convey shape; precise results will continue to use a stacked column chart.
  • Estimated results will be clearly labeled and will indicate the degree of precision.
  • Pattern analysis also works quickly over large-scales.
  • Events retrieval has been tuned to be 10x more efficient for massive-scale queries.
  • Histogram better displays very large numbers (for results with billions of hits).
• Filtering by Sources Feature:
  • Easily filter by one or more log sources using the new sources drop-down filter (next to org drop-down filter).
  • View the top 50k log sources over the time period (sorted by most common first).

Application v2024-12-21w - Lagging Data Sources & Deduplication

Features:

• Track lagging data sources and display ingestion health on dashboard.
  • Provide ability to copy detailed report to get list of lagging data sources.
• Deduplicate ingestion payloads larger than 16 KB (from same agent/IP).
  • Data sources that send duplicate packets will be marked as a lagging source for 30 minutes.
  • Data sources that send log events whose timestamps are older than 70 minutes will be marked as lagging for 30 minutes.

Application v2024-12-19w

Maintenance & Improvements:

• Logout loop solved if multiple browser tabs open
• Date/time picker implemented (known issue: time picker only works with touchscreen)
• Download context menu will warn if query parameters have changed since last search
• Search will automatically trigger if org selection changes

Application v2024-12-07 - Download Query Results

Features:

• Download query results as text, LQL, CSV, or NDJSON:
  • Download up to the first 1 million matching events for the current query.
  • Even large exports take less than 30 seconds to generate and download in compressed zip format.
  • Download links contain an embedded auth token and can be shared with others for up to 48 hours for easy collaboration outside your organization.

Application v2024-11-23s

Maintenance & Improvements:

• Fixed text wrapping so long JSON would not have cut off text.
• Implemented optimizations so vertical scrolling is faster for large result sets. Text selection in the main grid is off by default but can be enabled with a toggle button.
• Implemented a copy-to-clipboard button in the log context pane.