Activate Splunk AI Assistant for SPL through cloud connected

Splunk AI Assistant for SPL version 1.3.0 offers Splunk Enterprise on-premises customers the option to use the app through a new, cloud connected solution.

The cloud connected solution leverages Splunk-managed AI services in the cloud, with on-premises environments connecting to it. This solution offers a secure connection between your environment and Splunk managed cloud, with no GPU requirements.

For installation instructions for Splunk Cloud Platform users, see Install or upgrade Splunk AI Assistant for SPL (Cloud Version).

Version compatibility

See the following table for the compatible combinations of Splunk AI Assistant for SPL through cloud connected and Splunk Enterprise:

Splunk AI Assistant for SPL version	Splunk Enterprise version
1.3.0	9.2.x, 9.3.x, 9.4.x, or 10.x.

How is the connection made?

The cloud connection is established over HTTPS port 443 to ensure secure communication between your environment and Splunk Cloud Platform.

If your Splunk Enterprise deployment is behind a firewall, you must allow outbound access to the following domain:

Host name	Instances requiring access	Port
*.scs.splunk.com	Search head or search head cluster with Splunk AI Assistant for SPL	443

Installation process

Complete the following to access, install, and activate Splunk AI Assistant for SPL cloud connected solution:

Prerequisites

Before you can begin using Splunk AI Assistant for SPL you must review and sign the legal terms for the app. This specialized End-User License Agreement (EULA) covers data usage and is only accessible if you have a Splunk.com account. To review and sign these legal terms, see Splunk AI Assistant for SPL Registration.

The signed EULA is then reviewed by team members at Splunk. This review can take up to 72 hours.

Following review and approval, you will receive an email notification that Splunk AI Assistant for SPL is available for download and installation. Find the app on Splunkbase or through the in-product app browser. When using the in-product app browser search by "AI Assistant" to find the app listing .

The app download is only available for the account associated with the signed EULA.

Activation steps

Launch the app and complete the in-app onboarding process. This process includes the steps of Getting started, Create tenant code, Email tenant code, and Connect to cloud:

1. On the Getting started page, select Begin setup.
2. On the Create tenant code page, add your deployment information.
1. Add the company name, select a Splunk Cloud region, and provide your work email address.
2. For tenant configuration keep the default tenant, create a custom tenant, or connect to an existing tenant.
3. Select Next when ready.
3. The system generates a unique tenant code. Follow the guidelines on the Email tenant code page to submit this code to your onboarding specialist.
1. The tenant code you submit is reviewed and an activation code is then provisioned and sent to the email address you provided.

   Provisioning typically takes 2 business days.

4. On the Connect to cloud page, enter the activation token you received by email. Select Connect to cloud when ready.

   If you haven't received your activation token after 2 business days, contact splunkai@splunk.com for assistance.

5. (Optional) If your environment uses a proxy, you can configure a proxy server. This allows for the routing of traffic through your proxy and ensure a successful connection.

   You can also configure this later through the Settings page of the app.

After set-up is complete, you can use the assistant to create SPL searches, better understand SPL searches, and learn SPL. See Use Splunk AI Assistant for SPL.

What data leaves your environment

Splunk AI Assistant for SPL through cloud connected solution sends data from the customer managed platform environment to Splunk Cloud Platform. The type of data shared depends on your configuration choices.

You can choose from the following options:

Data sharing option	Description
Basic app setup with minimal data transfer	At a minimum, when you do not opt-in to share AI service data or personalization data, the app sends only what is required to power core functionality.
Data sharing for research and development	You can opt in or out of sharing anonymized usage data to help improve the product. Data sharing for research and development is required to provide feedback on individual interactions. To learn more, see What data is collected - share data.
Personalization data	Personalization lets the assistant tailor responses to your data, which can improve the quality of app responses. You can opt in or out of this feature. To learn more, see What data is collected - personalization data.

Configurations can be changed by an administrator at any time on the Settings page. See Configure Splunk AI Assistant for SPL.

Splunk AI Assistant for SPL uses the Splunk platform proprietary model. The assistant uses an open source LLM and performs inference in Splunk Cloud services. It does not leverage or send your data to third party services or APIs. Data remains within the Splunk platform cloud environment.

Splunk does not share customer data between customers. Customer metadata is not mixed or used for model training.

The assistant fully honors Splunk platform role-based access controls (RBAC). It does not execute SPL on behalf of a user, but routes users to search and reporting where RBAC and workload management are fully honored.