Splunk Mobile

Splunk Mobile

Building intentional AI features grounded in customer insight

Role

Lead product designer

Collaborators

1 designer, 1 PM, 6 engineers

timeline

May 2025 - Present

About Splunk Mobile

About Splunk Mobile

I inherited Splunk Mobile as a black box: no documentation, no user list, no roadmap, and an engineering team just as new to it as I was. We shared one job: prove the app's value before anyone would keep investing in it.

My approach was two-track: ship fast enough to earn research access at .conf25, then use that research as leverage, including to challenge a leadership-driven AI direction I didn't think fit users.

Initial challenges

Initial challenges

✻

Data scarcity: No inherited personas, journey maps, or usability benchmarks.

✻

Knowledge gap: A newly hired engineering team with no historical context on the codebase.

✻

Market pressure: A need to prove the mobile app's value to high-level stakeholders (executives) to justify continued investment.

Earning research access

Earning research access

I interviewed the Director of Engineering to map who used the app: executives wanting one glanceable visualization for meetings, IT Ops wanting alerts and dashboards on the go.

I shipped Saved Visualizations, letting users pin key dashboard panels to the home screen, as a one-month MVP timed for .conf25. It wasn't the end goal. It was my way onto the conference floor.

Saved visualizations feature allows users to add their most-viewed charts directly to the home screen.

.conf25: the research that changed everything

.conf25: the research that changed everything

I conducted scrappy research on the conference floor with surveys and usability testings scripts I wrote myself. I even built out a Splunk Mobile demo booth out of extra tables from another area I was working on. Out of this, three quality insights arose.

Awareness is there

Awareness is there

29% use Mobile, 38% more have heard of it. I even got to talk to old beta testers who were waiting to be contacted again.

Solidified personas

Solidified personas

Top beneficiaries: Executives, IT Ops, Admins. Confirms the internal discovery I conducted.

Path forward

Path forward

Most requested: dashboard summaries and anomaly recommendations. This became the roadmap.

Split paths: how to proceed?

Split paths: how to proceed?

Right after .conf25, leadership pushed AI Canvas, a Cisco-wide chat interface for generating dashboards, betting it would help mobile users debug on the go.

That's not what I'd just heard from users. They wanted AI to surface insight, not a dashboard-building tool on a phone. So I tested both concepts instead of just disagreeing.

Concept testing: two directions, one study

Concept testing: two directions, one study

AI Canvas (leadership's direction)

AI Canvas (leadership's direction)

Chat-based assistant: ask a question, get a chart, save it, revisit history.

AI Alerting (my counter-proposal)

AI Alerting (my counter-proposal)

Push notification surfaces an AI incident summary, with a contextual investigation thread.

Results and impact

Results and impact

✻

AI Canvas confused people. "Canvas" wasn't a familiar enough term to carry its own usage.

✻

Nobody wanted to build dashboards on mobile. They trust their desktop setup; mobile is for knowing, not creating.

✻

AI Alerting landed. Users valued insight pushed to them, with room to dig deeper.

Research, not opinion, pivoted the AI roadmap from Canvas to Alerting. I turned a black box into a validated research pipeline, a shipped MVP, and a data-backed reversal of a company-wide leadership initiative, keeping Splunk Mobile focused on what it actually is: an on-the-go command center.

👋 Thanks for stopping by!

👋 Thanks for stopping by!

👋 Thanks for stopping by!