Splunk® AI Assistant for SPL

Install and use Splunk AI Assistant for SPL

This documentation does not apply to the most recent version of Splunk® AI Assistant for SPL. For documentation on the most recent version, go to the latest release.

About the Splunk AI Assistant

The Splunk AI Assistant is available as a preview and is not officially supported. See Splunk General Terms for more information.

Splunk platform users interact with Splunk products using the domain-specific Search Processing Language (SPL). It can take time and effort to learn SPL and how to create and interpret SPL searches. The Splunk AI Assistant makes SPL more accessible, enabling users to create SPL queries from plain English, and view plain English explanations of any well-formed SPL searches.

The Splunk AI Assistant uses language modeling and semantic parsing. The app uses the Text-To-Text Transfer Transformer (T5) model as the base language model for SPL translation tasks. The T5 model is a transformer-based language model pre-trained on large unlabeled datasets to learn the high-level representations of natural language sequences.

The app uses English-to-SPL translation pairs, and it fine-tunes the model for translating a plain English description to a corresponding SPL search and the other way around. The Splunk AI Assistant does not rely on external connections, nor does it interact with data stored in any Splunk index, to return results.

Splunk AI Assistant features

You can take these actions with the Splunk AI Assistant:

  • Write a task in plain English and have the app convert this task into a usable SPL search.
  • Copy and paste an SPL search and have the app convert this search to plain English.


In order to successfully run the Splunk AI Assistant, meet these requirements:

The resource consumption of the app is commensurate with the number of tasks the app is working on. Each task requires approximately 1GB of memory. For example if you have 10 users each asking the app to write or explain SPL at the same time, 10GB of memory is used.

Last modified on 02 February, 2024
  Using the Splunk AI Assistant

This documentation applies to the following versions of Splunk® AI Assistant for SPL: 0.2.2, 0.2.3, 0.2.4, 0.2.5

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters