Troubleshoot Splunk AI Assistant for SPL

The following are issues you might experience when using Splunk AI Assistant for SPL and how to resolve them.

App shows as restricted in Splunkbase

Cause

If you are seeing a message that the app is restricted when you try to download it from Splunkbase, there are 2 likely causes:

• You have not yet signed the required legal terms to access Splunk AI Assistant for SPL.
• You have signed the required legal terms but your request for app access has not yet been processed. This can take up to 4 business days.

Solution

Complete signing the required legal terms to access Splunk AI Assistant for SPL, or wait the needed number of days for Splunk to process your signed legal terms.

You must sign the legal terms even if you signed up for previous preview versions of the app.

Not seeing the option to give feedback, no thumbs up or thumbs down icon as seen in screenshots and demos

Cause

This feedback feature is only available to customers who have opted into data sharing.

Solution

Sharing data to Splunk is turned on by default but you can opt-out on the Settings page. If you opt-out, you can opt back in anytime. To learn more, see Share data in Splunk AI Assistant for SPL.

App is giving no results at all

Cause

Splunk AI Assistant for SPL includes guardrails that are designed to promote safety and appropriateness of interactions with the app. If you don't get a response to a prompt, even when that prompt looks fine to you, it might be due to these guardrails.

Solution

Try rephrasing your prompt and make sure you follow prompt guidelines. For more information, see Guardrails in Splunk AI Assistant for SPL.

Responses being overwritten, seeing other user chat history, and other unexpected app behavior

Cause

If you have multiple people logged in to the same account and are using the assistant at once, there is potential for this kind of app behavior.

Solution

The app stores each Splunk account's chat history as its own KVStore object, so if two people are using the same account, and they make a request at the same time, you might see another person's chat history, or have one response overwrite another, or other strange app behavior.

For good results from the app, have each user login with their own username and password, and do not use a shared username and password.

App is slow to give results

Cause

Version 1.0.0 of the app has no throttling or prompt limits, and a slow response can be due to factors within or beyond the Splunk platform.

Solution

Degraded service can result in slow replies and can happen at any time. Aim to not abuse or overload the app with an excessive number of simultaneous prompts.

App access as a Splunk Enterprise user

Cause

Can non Splunk Cloud customers get app access?

Solution

The app is only available to Splunk Cloud Platform customers due to architectural considerations needed for the GPU-based cloud AI service powering high performance LLM responses. The Splunk team is evaluating ways to bring the app to Splunk Enterprise customers in the future.