Thirty years of asking why.
The Dutch Data Difference builds production-ready enterprise software for the Splunk ecosystem born from Eduard Lekanne’s three decades of working with data, and a stubborn need to understand why technology works the way it does.
The Story
It started with a packet sniffer.
In 1994, I was a network engineer watching applications talk to each other over 64 kbps ISDN lines. While colleagues maintained the network, I was fascinated by something else: why were these applications sending so much data? I spent my days sniffing traffic, reading meters of technical books Google didn’t exist yet and digging until I understood every technology down to its concepts.
That habit never left me. Performance engineering at a major Dutch bank’s competence center. Technical pre-sales for BSM and CMDB products at Mercury Interactive and HP Software. Then, in 2009, the decision that defined everything after: I went independent because I kept selling solutions that nobody could deliver, and I wanted to be the one who delivered them.
That’s when I found Splunk. Instead of crawling through gigabytes of log files with Perl and Python scripts, I could bring the data into one platform, analyze it, and build monitoring on top. I went deep, the way I always do: Splunk Enterprise Certified Architect, Core Certified Consultant, and years as an ITSI specialist inside some of Europe’s largest enterprise environments banking, insurance, automotive.
Then I audited myself.
After years of building searches, dashboards, alerts, and ML models for enterprise customers, I asked an uncomfortable question: where did my time actually go?
The honest answer: translating what people wanted into SPL, over and over. And investigating “critical” alerts that turned out to be broken data pipelines a changed log format, a timestamp issue, a parsing error hiding in an invisible index.
The bottleneck was never Splunk. It was the distance between what people want and what they can express. So I built the product that closes it.
What I build
AI Workbench lets anyone talk to Splunk in plain English and get back real, validated SPL, dashboards, alerts, ML models, and security investigations grounded in your running instance, governed by your existing Splunk roles, with your choice of LLM. No data leaves your perimeter unless you decide it does.
It carries everything those thirty years taught me:
Honesty over comfort.
If a search finds nothing, AI Workbench says so. No reassuring green zeros, ever. Trust is the only real asset a software vendor has.
Context over isolated answers.
No search should run blind. Every analysis is informed by the knowledge in Splunk Security Essentials and ES Content Update, and by the health of the data itself TrackMe, internal indexes, even Cribl pipeline errors. Because the most expensive mistake in monitoring is a confident answer built on broken data.
Inside the platform, not next to it.
AI Workbench uses Splunk’s own authentication, roles, KVStore, and encrypted password store. If an analyst can’t see an index, neither can the assistant. Governance isn’t bolted on it’s the foundation.
The company
One builder. Built like an enterprise.
The Dutch Data Difference is the product label of ITMIP, founded and run by me, Eduard Lekanne, from the Netherlands. That’s not a limitation it’s the design.
Being a one-person company in the AI era means radical focus and a direct line: the person who answers your support ticket is the person who architected the product. There is no product committee between your feedback and the roadmap. And modern AI-assisted development means I ship with the velocity, documentation discipline, and test rigor of a much larger team every release is specified, verified, and tested before it ever reaches Splunkbase.
What a small company cannot fake is enterprise depth. That part comes from the field: tenancy and role-based scoping, bring-your-own-key LLM support across eight provider families (including fully local, air-gapped models), audit trails built for legal defensibility, and a licensing model your procurement team will actually understand.
The person
Why “The Dutch Data Difference”?
The Dutch Data Difference is the product label of ITMIP, founded and run by me, Eduard Lekanne, from the Netherlands. That’s not a limitation it’s the design.
Being a one-person company in the AI era means radical focus and a direct line: the person who answers your support ticket is the person who architected the product. There is no product committee between your feedback and the roadmap. And modern AI-assisted development means I ship with the velocity, documentation discipline, and test rigor of a much larger team every release is specified, verified, and tested before it ever reaches Splunkbase.
What a small company cannot fake is enterprise depth. That part comes from the field: tenancy and role-based scoping, bring-your-own-key LLM support across eight provider families (including fully local, air-gapped models), audit trails built for legal defensibility, and a licensing model your procurement team will actually understand.
Try AI Workbench free on https://splunkbase.splunk.com/app/8747 the Personal tier requires no license, no registration, no credit card. And if you have feedback, especially critical feedback: I read every message myself.