About the Splunk AI Assistant

The Splunk AI Assistant version 0.3.4 is part of a Preview Program and is not officially supported. See Splunk General Terms for more information.

Splunk platform users interact with Splunk products using the domain-specific Search Processing Language (SPL). It can take time and effort to learn how to write SPL and how to interpret SPL searches.

The Splunk AI Assistant is a generative AI-powered assistive app that makes SPL more accessible. The app accelerates your learning by generating SPL with a natural language prompt, and breaking SPL down into digestible parts. The app also increases Splunk platform knowledge by explaining Splunk platform products, terms, and functionality.

The Splunk AI Assistant offers an intuitive chat experience all within a familiar Splunk platform interface.

How the app works

The Splunk AI Assistant uses language modeling and semantic parsing. The app uses the Text-To-Text Transfer Transformer (T5) model as the base language model for SPL translation tasks. The T5 model is a transformer-based language model pre-trained on large unlabeled datasets to learn the high-level representations of natural language sequences.

The app uses English-to-SPL translation pairs, and it fine-tunes the model for translating a plain English description to a corresponding SPL search and the other way around. The Splunk AI Assistant does not rely on external connections, nor does it interact with data stored in any Splunk index, to return results.

Splunk AI Assistant features

You can complete the following tasks with the Splunk AI Assistant:

• Write a task in plain English and have the app convert this task into a usable SPL search.
• Copy and paste an SPL search and have the app convert this search to plain English.
• Input a plain English question, or a Splunk platform term or product name and have the app provide further information sourced from Splunk documentation.
• Iterate on task responses with a conversational user experience.

Preview Program requirements

Version 0.3.4 of the Splunk AI Assistant is only available for Splunk Cloud customers in US-East.

In order to successfully run version 0.3.4 of the Splunk AI Assistant, you must meet the following requirements:

1. Be running Splunk Enterprise 9.1.0 or higher, or Splunk Cloud Platform.
2. A US-East non-compliant Cloud stack.
3. Participate in 30 to 60 minute weekly feedback calls with Splunk's Early Production Team (EPAT) and Product Management teams over a 3-week period.
4. Willingness to share your experience as an early adopter with other customers either in private, one-on-one conversations, or in more public ways such as case studies, blog posts, and presentations.

If you are not eligible for this preview, you can try the earlier version of the app. The earlier version enables the translation of plain English to SPL, and SPL to plain English. See Splunk AI Assistant version 0.2.5.