Explore Signals

In your browser, go to the Splunk Agent Observability console at https://console.multitenant.sao.splunkcloud.com and workshop org

Open the Splunk Agent Observability Workshop project, and select the agent stream that matches the Instance ID you found above (such as shw-51ea).

Click on the Signals tab:

Ensure the LLM is set to gpt-5 (Azure), then click the Generate Signals button.

It will take a few moments to analyze the traces in this agent stream and generate signals.

We can see that several signals have been generated for our agent stream (the specific signals will vary from one agent stream to the next):

Select a signal and read its actionable context: what the pattern is, why it’s happening, and the recommended next step.

For example, let’s click on the signal named PII in tool outputs:

This signal explains that the get_patient_info tool response contains full patient PII (address and phone) and database/SQL metadata, even though the assistant response to the user only exposes limited fields (name, patient_type, prescription). This still creates a privacy and compliance risk because the sensitive data is present in tool outputs and therefore in your observability logs and in the model context.

It provides a suggested action to remediate the issue, which is to minimize and/or redact PII in get_patient_info tool outputs (and logs) to prevent sensitive data exposure.

From the signal, we can pivot into the specific traces that make up the pattern:

This allows us to go from “there’s a recurring problem” to “here are the exact requests behind it” in a couple of clicks, exactly the targeted remediation Signals are designed to enable.