Splunk® AI Assistant for SPL

Install and use Splunk AI Assistant for SPL

This documentation does not apply to the most recent version of Splunk® AI Assistant for SPL. For documentation on the most recent version, go to the latest release.

Share data in the Splunk AI Assistant

When the Splunk AI Assistant is deployed on the Splunk platform, the Splunk platform sends aggregated usage data to Splunk Inc. ("Splunk") to improve the Splunk AI Assistant in future releases. For information about how to opt in or out and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

How to opt in or out of sharing data

Sharing data is turned off by default. You can turn data sharing on from within the Splunk AI Assistant on the Settings tab of the app. Select the box next to "Share my data with Splunk" as shown in the following image:

This image shows the Settings tab of the Splunk AI Assistant. A tick-box labeled as Share my data with Splunk is highlighted.

What data is collected

The Splunk AI Assistant collects the following basic usage information:

Component Description Example
app.Splunk_AI_Assistant.splgen Anonymous operation data.
{
	"executionID": "B90188D3-66A0-49F4-87BE-7460FBCF912D",
	"app": "Splunk_AI_Assistant",
	"eventID": "D16C910A-B150-4677-A2AF-D42C21D5D011",
	"timestamp": 1688787183,
	"type": "aggregate",
	"deploymentID": "bef01542-a563-5ded-8897-c85ac8a1d467",
	"component": "app.Splunk_AI_Assistant.splgen",
	"visibility": ["anonymous"],
	"original_timestamp": 1688787183,
	"optInRequired": 3,
	"data": {
		"_time": 1688763330,
		"PID": "2112",
		"UUID": "775ca183-33ed-4900-a068-2918831f3aa4",
		"command": "splgen",
		"apply_time": "24.113"
		"_sourcetype": "splgen",
		"_indextime": 1689312330,
		"session_id": "'775ca183-33ed-4900-a068-2918831f3aa4'",
		"correct": "true",
		"_kv": 1,
		"_serial": 0
	}
}
app.Splunk_AI_Assistant.splgen Anonymous feedback data.
{
	"executionID": "B90188D3-66A0-49F4-87BE-7460FBCF912D",
	"app": "Splunk_AI_Assistant",
	"eventID": "D16C910A-B150-4677-A2AF-D42C21D5D011",
	"timestamp": 1688787183,
	"type": "aggregate",
	"deploymentID": "bef01542-a563-5ded-8897-c85ac8a1d467",
	"component": "app.Splunk_AI_Assistant.splgen",
	"visibility": ["anonymous"],
	"original_timestamp": 1688787183,
	"optInRequired": 3,
	"data": {
		"_time": 1688763330,
		"response": "'Concise Summary:\nThe query retrieves the total number of buckets per peer in a Splunk cluster.\nDetailed Explanation:\n- `| rest splunk_server=local /services/cluster/master/peers`: This part of the query uses the REST command to access the local Splunk cluster master'",
		"_sourcetype": "splgen_feedback",
		"_indextime": 1688763330,
		"query": "'| rest splunk_server=local /services/cluster/master/peers | stats sum(bucket_count) by label | rename label as peer'",
		"_raw": "session_id='775ca183-33ed-4900-a068-2918831f3aa4' query='| rest splunk_server=local /services/cluster/master/peers | stats sum(bucket_count) by label | rename label as peer',response='Concise Summary:\nThe query retrieves the total number of buckets per peer in a Splunk cluster.\nDetailed Explanation:\n- `| rest splunk_server=local /services/cluster/master/peers`: This part of the query uses the REST command to access the local Splunk cluster master's REST API and fetch information about indexer peers.\n- `| stats sum(bucket_count) by label`: The'stats' command is used to calculate the total number of buckets (`sum(bucket_count)`) for each peer ('by label').\n- `| rename label as peer`: Finally, the'rename' command is used to change the name of the 'label' field to 'peer'.: undefined',correct=true",
		"session_id": "'775ca183-33ed-4900-a068-2918831f3aa4'",
		"correct": "true",
		"_kv": 1,
		"_serial": 0
	}
}
Last modified on 20 July, 2023
Using the Splunk AI Assistant   Learn more about the Splunk AI Assistant

This documentation applies to the following versions of Splunk® AI Assistant for SPL: 0.2.2, 0.2.3, 0.2.4, 0.2.5


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters