Troubleshoot Splunk AI Assistant for SPL

The following are issues you might experience when using Splunk AI Assistant for SPL and how to resolve them.

App shows as restricted in Splunkbase

Cause

If you are seeing a message that the app is restricted when you try to download it from Splunkbase, there are 2 likely causes:

• You have not yet signed the required legal terms to access Splunk AI Assistant for SPL.
• You have signed the required legal terms but your request for app access has not yet been processed. This can take up to 4 business days.

Solution

Complete signing the required legal terms to access Splunk AI Assistant for SPL, or wait the needed number of days for Splunk to process your signed legal terms.

You must sign the legal terms even if you signed up for previous preview versions of the app.

Seeing a "service not initialized" or 401 unauthorized error

Cause

If you have an active Splunk Cloud Platform subscription on an AWS commercial stack, and you have accepted the Splunk AI Assistant for SPL EULA, but you see this error, then this issue is stemming from the Splunk Cloud Platform side. You have not been correctly onboarded to the tenant and an empty token is being sent to the service.

Solution

Create a Splunk Support ticket and this onboarding error can be corrected.

Cannot find the app in the in-product app browser

Cause

For app installations or upgrades, there is a Splunk platform known issue that prevents searching for "Splunk AI Assistant" in the in-product app browser.

Solution

When using the in-product app browser, search by "AI Assistant" to find the listing for Splunk AI Assistant for SPL. The following image shows an example of this in-product app browser search successfully finding the app:

Not seeing the option to give a thumbs up or thumbs down on app results, as seen in screenshots and demos

Cause

This feedback feature is only available to customers who have opted into data sharing.

Solution

Sharing data to Splunk is turned on by default but you can opt-out on the Settings page. If you opt-out, you can opt back in anytime. To learn more, see Share data in Splunk AI Assistant for SPL.

Not seeing the option to provide app feedback

Cause

If you do not see the option to provide a thumbs up or thumbs down on app results, your Splunk administrator has chosen to opt-out of data sharing. Data sharing can only be turned off or back on by those users with write permissions for Splunk AI Assistant for SPL. And whether data sharing is turned off or on, that setting applies at the app level, across all users, and not at the individual user level.

Solution

If you want to be able to provide app feedback, your Splunk platform administrator needs to go back to the app Settings page and choose to turn data sharing back on.

App is giving no results at all

Cause

Splunk AI Assistant for SPL includes guardrails that are designed to promote safety and appropriateness of interactions with the app. If you don't get a response to a prompt, even when that prompt looks fine to you, it might be due to these guardrails.

Solution

Try rephrasing your prompt and make sure you follow prompt guidelines. For more information, see Guardrails in Splunk AI Assistant for SPL.

App providing strange or seemingly incorrect responses

Cause

If you pose multiple questions to the assistant, it's possible the previous context in the chat history can throw the assistant off. In a multi-turn chat the input context can become too noisy, and cause hallucinations to occur.

Solution

For better results, start a new chat whenever possible.

Responses being overwritten, seeing other user chat history, and other unexpected app behavior

Cause

If you have multiple people logged in to the same account and are using the assistant at once, there is potential for this kind of app behavior.

Solution

The app stores each Splunk account's chat history as its own KVStore object, so if two people are using the same account, and they make a request at the same time, you might see another person's chat history, or have one response overwrite another, or other strange app behavior.

For good results from the app, have each user login with their own username and password, and do not use a shared username and password.

App is slow to give results

Cause

Version 1.0.0 of the app has no throttling or prompt limits, and a slow response can be due to factors within or beyond the Splunk platform.

Solution

Degraded service can result in slow replies and can happen at any time. Aim to not abuse or overload the app with an excessive number of simultaneous prompts.

App access as a Splunk Enterprise user

Cause

Splunk AI Assistant for SPL is not available for on-premises Splunk Enterprise customers.

Solution

The app is only available to Splunk Cloud Platform customers due to architectural considerations needed for the GPU-based cloud AI service powering high performance LLM responses. The Splunk team is evaluating ways to bring the app to Splunk Enterprise customers in the future.