About the Splunk AI Assistant

The Splunk AI Assistant is available as a preview and is not officially supported. See Splunk General Terms for more information.

Splunk platform users interact with Splunk products using the domain-specific Search Processing Language (SPL). It can take time and effort to learn SPL and how to create and interpret SPL searches. The Splunk AI Assistant makes SPL more accessible, enabling users to create SPL queries from plain English, and view plain English explanations of any well-formed SPL searches.

The Splunk AI Assistant uses language modeling and semantic parsing. The app uses the Text-To-Text Transfer Transformer (T5) model as the base language model for SPL translation tasks. The T5 model is a transformer-based language model pre-trained on large unlabeled datasets to learn the high-level representations of natural language sequences.

The app uses English-to-SPL translation pairs, and it fine-tunes the model for translating a plain English description to a corresponding SPL search and the other way around. The Splunk AI Assistant does not rely on external connections, nor does it interact with data stored in any Splunk index, to return results.

Splunk AI Assistant features

You can take these actions with the Splunk AI Assistant:

• Write a task in plain English and have the app convert this task into a usable SPL search.
• Copy and paste an SPL search and have the app convert this search to plain English.

Requirements

In order to successfully run the Splunk AI Assistant, meet these requirements:

• Have Splunk Enterprise 9.0.0 or higher, or Splunk Cloud Platform
• Install version 4.0.0 or higher of the Python for Scientific Computing (PSC) add-on from Splunkbase for your operating system:
  • Mac OS environment
  • Windows 64-bit environment
  • Linux 64-bit environment

The resource consumption of the app is commensurate with the number of tasks the app is working on. Each task requires approximately 1GB of memory. For example if you have 10 users each asking the app to write or explain SPL at the same time, 10GB of memory is used.