Share data in the Splunk AI Assistant

When the Splunk AI Assistant is deployed on the Splunk platform, the Splunk platform sends aggregated usage data to Splunk Inc. ("Splunk") to improve the Splunk AI Assistant in future releases. For information about how to opt in or out and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

How to opt in or out of sharing data

Sharing data is turned off by default. You can turn data sharing on from within the Splunk AI Assistant on the Settings tab of the app. Select the box next to "Share my data with Splunk" as shown in the following image:

What data is collected

The Splunk AI Assistant collects the following basic usage information:

Component	Description	Example
app.Splunk_AI_Assistant.splgen	Anonymous operation data.	{ "executionID": "B90188D3-66A0-49F4-87BE-7460FBCF912D", "app": "Splunk_AI_Assistant", "eventID": "D16C910A-B150-4677-A2AF-D42C21D5D011", "timestamp": 1688787183, "type": "aggregate", "deploymentID": "bef01542-a563-5ded-8897-c85ac8a1d467", "component": "app.Splunk_AI_Assistant.splgen", "visibility": ["anonymous"], "original_timestamp": 1688787183, "optInRequired": 3, "data": { "_time": 1688763330, "PID": "2112", "UUID": "775ca183-33ed-4900-a068-2918831f3aa4", "command": "splgen", "apply_time": "24.113" "_sourcetype": "splgen", "_indextime": 1689312330, "session_id": "'775ca183-33ed-4900-a068-2918831f3aa4'", "correct": "true", "_kv": 1, "_serial": 0 } }
app.Splunk_AI_Assistant.splgen	Anonymous feedback data.	{ "executionID": "B90188D3-66A0-49F4-87BE-7460FBCF912D", "app": "Splunk_AI_Assistant", "eventID": "D16C910A-B150-4677-A2AF-D42C21D5D011", "timestamp": 1688787183, "type": "aggregate", "deploymentID": "bef01542-a563-5ded-8897-c85ac8a1d467", "component": "app.Splunk_AI_Assistant.splgen", "visibility": ["anonymous"], "original_timestamp": 1688787183, "optInRequired": 3, "data": { "_time": 1688763330, "response": "'Concise Summary:\nThe query retrieves the total number of buckets per peer in a Splunk cluster.\nDetailed Explanation:\n- `| rest splunk_server=local /services/cluster/master/peers`: This part of the query uses the REST command to access the local Splunk cluster master'", "_sourcetype": "splgen_feedback", "_indextime": 1688763330, "query": "'| rest splunk_server=local /services/cluster/master/peers | stats sum(bucket_count) by label | rename label as peer'", "_raw": "session_id='775ca183-33ed-4900-a068-2918831f3aa4' query='| rest splunk_server=local /services/cluster/master/peers | stats sum(bucket_count) by label | rename label as peer',response='Concise Summary:\nThe query retrieves the total number of buckets per peer in a Splunk cluster.\nDetailed Explanation:\n- `| rest splunk_server=local /services/cluster/master/peers`: This part of the query uses the REST command to access the local Splunk cluster master's REST API and fetch information about indexer peers.\n- `| stats sum(bucket_count) by label`: The'stats' command is used to calculate the total number of buckets (`sum(bucket_count)`) for each peer ('by label').\n- `| rename label as peer`: Finally, the'rename' command is used to change the name of the 'label' field to 'peer'.: undefined',correct=true", "session_id": "'775ca183-33ed-4900-a068-2918831f3aa4'", "correct": "true", "_kv": 1, "_serial": 0 } }