Splunk's No more "I don't knows."
A quick note: Everything I’m sharing here is my subjective take on Splunk’s No more “I don’t knows.” campaign as I’m not privy to their performance metrics or strategy. The recommendations at the end are offered with deep respect for the Splunk marketing team and is purely a thought exercise in how I might have approached certain elements differently.
For anyone that’s not familiar with the Security Operations (SecOps) software category, Splunk is a leader in Observability (one of the subcategories of SecOps) meaning they ingest machine data from across an org’s systems and make it searchable and visible in one place, so teams can monitor, investigate, and respond to what’s happening across their infrastructure.
Observability is one of the harder subcategories in security to market, and the reason is that the core message (Centralize your data to get visibility across your systems) has been worn smooth. Every vendor in the space says a version of it, and security leaders have heard it so many times they’ve gone numb to it. The moment you open with it, you’ve lost the room. So the real challenge for Splunk was getting the core message across in a way that moves people, because the message itself had stopped making ears perk years ago.
On an aside, I often say that the best marketing is marketing that moves people.
Splunk cleared that bar here by reaching for a real experience: the endless, sinking string of "I don't knows" that follows an incident nobody can trace. It's a 64 second video built around one moment. "The check out is down." From there, a business exec moves through the building trying to find out what's happening, and the campaign video becomes a montage of the same answer, delivered by nearly everyone asked.
The Villian is One Sentence
I really, really appreciated that the outage is not the antagonist. “The check out is down” shows up in the first 5 seconds of the video and never returns.
Nobody in this ad is fighting a technical failure, which we see many, many times in security marketing. What they’re fighting, over and over, is one sentence: “I don’t know.” Splunk built the entire video around the reaction to an incident rather than the incident itself, and the reaction it chose is the specific, sinking uncertainty of not knowing who owns the problem while the clock runs.
Watch what that does to the product claim.
Splunk sells visibility across systems. The emotional problem the film dramatizes is that nobody has the answer. Every “I don’t know” is the result of not having visibility. By the time the resolution arrives, the ad hasn’t described the value of visibility, it has spent 40 seconds making you feel its absence. That inversion is perfect because it requires trusting the negative space. Splunk sells the presence of something by dramatizing what its absence feels like.
The payoff line closes the loop. “I didn’t know Splunk could do that” puts the last “I don’t know” in the mouth of the exec who’d been drowning in them, then answers it with the product. The film’s problem and the film’s resolution are the same three words, turned around. So, so good. Bravo Splunk team!
“I don’t know.” is Funny. And Deep.
Yes, the repetition is funny. Same phrase, new room, rising absurdity, right down to the bathroom stall. But the gag is the surface. Underneath it, the repetition is doing deliberate work.
It’s not just funny. It’s an argument.
Look at where the “I don’t knows” come from. An engineer at his desk. A security lead in the open floor. Someone in a phone booth. Someone on a video call. Someone in a bathroom. The non-answer crosses every role and nearly every physical space in the building. The cumulative effect is that the visibility gap is not one person’s failure to do their job. It’s organizational. It sits across teams, across functions, across floors.
And that maps precisely onto what Splunk actually claims to be: a layer that sits across systems.
When everyone gives the same non-answer, the problem stops looking like one person's mistake and starts looking like the way the whole place is built. A gap that spans the organization needs a fix that spans the organization, and that's precisely what Splunk sells. The joke isn't just memorable. It's carrying the strategy.
Splunk Told You Who They Are
One more piece of credit before I turn to the gaps, because it’s (surprisingly) rare enough to name on its own.
I have watched a lot of security advertising that is charming, well-produced, and completely opaque as to what the company actually does. You finish it entertained and unable to name what in the world they do. Splunk didn’t make that mistake.
Between the video’s resolution and the end cards, you walk away with absolute clarity that Splunk is in the Observability category.
What I Might Have Explored Differently
My first point is about differentiation.
The ad tells you who Splunk is. It doesn’t tell you why Splunk over anyone else. The response I usually get to this recommendation is that a brand video is not the place. Of which, I ALWAYS counter that adding your key differentiator is such a quick & easy add that it’s a no brainer, and the impact of adding it is tremendous.
Once a video like this makes the category and the problem legible, the buyer’s very next question is the obvious one: plenty of vendors promise visibility across systems, so why you?
The ad never answers it.
The differentiator isn’t buried in a secondary asset, which is the usual culprit. It’s simply absent. And the fix costs almost nothing, because the real estate is already there. “Know it. Fix it. Build resilience.” is the video’s end card with open space beneath it. Add a one-liner on the key differentiator and you are good to go.
My second point is the bigger one, and it’s less about the creative and more about the ambition around it.
In my opinion, calling this a campaign is a bit of a stretch. And it’s very likely that Splunk didn’t consider this a campaign, in which case it’s my mistake for defining it as such. But nonetheless, it’s a learning point for us all. A single video with paid distribution behind it is a tactic, not a campaign. I see this pattern often. A performance marketing team needs to move a metric, engages an agency to produce a video, puts spend behind it, and calls it a campaign. I struggle with this because when you consider a singular tactic like this a campaign, then does that make everything that marketing does a campaign?
What’s missing is a campaign architecture. If you are going to invest this much craft and budget into an idea this good, get mileage out of it. It doesn’t require a dozen assets. It requires a well thought out, resourceful campaign architecture.
And the raw material for that architecture is sitting right there. “I didn’t know Splunk could do that” is one line away from a webinar series. Picture “I Didn’t Know Splunk Could...”, each session dedicated to a specific use case, each one taking the concept a layer deeper into the exact problems and the value of solving them. That’s the move that turns awareness into demand, because that’s where prospects raise their hand to talk to you now rather than remembering your name in two years.
Also, the obvious “create a landing page” but I beat that drum every other post. The point is, regardless of how big or small the campaign is, please squeeze as much as you can out of a project like this. I’ve found so many times in my career that driving performance could often be found from existing initiatives rather than defaulting to launching something new.
The Bottom Line
This is a strong piece of creative built on a strong insight. Splunk found the human truth underneath an abstract category, made “I don’t know” the antagonist, and let the structure of the video carry the argument that the problem is systemic. Seriously, well done Splunk.
I’ll close on this (and it’s what I’m most excited about). No more “I don’t knows.” doesn’t feel like a line that was invented in a conference room.
It feels overheard.
It has the texture of something a customer actually said, in a meeting or on a call, while describing a bad day. I can’t confirm that, and I’m speculating.
But the strongest campaign ideas almost always come from the field rather than the whiteboard, sourced from the people living the problem day in and day out, and this line carries that ring of truth. If it was pulled from a customer conversation, that’s the whole game, because it’s the difference between a concept that sounds clever in the room and one that lands as true with the market.
The idea here is that good.
Every week, I write about a marketing campaign in the cybersecurity software space that stands out strategically and/or has creative execution worth studying. And every quarter, I select three “Campaigns of the Quarter” where the marketers who led the campaigns receive a free, personalized Funko Pop. Yes, I’m serious. Here’s mine as proof:
If you’ve led a campaign you’re proud of or know someone who has, message me on Substack or LinkedIn to submit it. I want to see what you’re building.
Originally published on Campaign Telemetry.
Read on Substack