Turn Splunk Assist on or off

After you configure your Splunk Enterprise deployment for Splunk Assist, you must then turn it on. After you activate Splunk Assist, you can then begin seeing insights in your Splunk Enterprise deployment inside the Assist highlights page.

There is no cost to turn on Splunk Assist. You don't need to buy a new license to use the service, nor do you need any kind of activation code. The activation step is solely for authentication, to ensure that only authorized Splunk customers have access to Splunk Assist insights and reports.

After you successfully turn on Splunk Assist, it begins downloading updates automatically and periodically to ensure it has the latest software to provide insights on your Splunk Enterprise deployment. This auto-update process for Splunk Assist occurs in the background, and you don't need to do anything to trigger it.

Turn on Splunk Assist

Before you can turn on Splunk Assist, you must have the following in place:

• You must have already enabled support usage data.
• Your Splunk Enterprise instance must be able to connect with Splunk cloud services.
• You must have a valid existing Enterprise license. You do not need to buy a new license solely to use Splunk Assist.

The "Turn on Splunk Assist" page checks for all of these requirements automatically after you start the activation process. If you satisfy them, Splunk Assist turns on immediately after you follow this procedure.

1. Log into a running Splunk Enterprise search head instance that runs Monitoring Console.
2. From the system bar, choose Settings > Monitoring Console.
3. After the Monitoring Console page loads, click Assist from the Monitoring Console menu. The "Splunk Assist" page loads.
4. Select Turn on Splunk Assist. the "Turn on Splunk Assist" page loads and Splunk Assist begins assessing the readiness of your Splunk Enterprise instance to use Assist. The following steps might appear depending on your instance readiness.
   1. If you have not enabled support usage data, the "Turn on Splunk Assist" page advises you of this. Select Enable support usage data and follow the instructions at Share performance data in Splunk Enterprise. Then, return to this page and select Retry.
   2. If you have not configured this Splunk Enterprise instance to connect to Splunk Cloud services, or the instance can't access those services, the "Turn on Splunk Assist" page advises you of this. Select Set up Splunk Cloud services to learn how to enable access to Splunk Cloud services. Then, return to this page and select Refresh connection.
   3. Splunk Assist needs a valid license ID to turn on. If it can't find one, the "Turn on Splunk Assist" page prompts you for one. If that happens, enter the license globally unique identifier (GUID) into the text box, then select Turn on Splunk Assist. If you don't have a license ID, then click the Contact Splunk Support button for help on getting one.
5. If your Splunk Enterprise instance is properly set up, then you see the message "You're all set! You can now turn on Splunk Assist. Click Turn on Splunk Assist.

Assist can take a few minutes to activate. After activation, Assist begins gathering insights immediately, but you might not see results initially for up to an hour.

Turn off Splunk Assist

If you need to turn off the Splunk Assist service, for example if your Splunk Enterprise instance is in an environment where it can't, or you don't want it to connect to Splunk cloud services, you can stop the service by disabling the Splunk Assist app.

On the search head where Splunk Assist is attempting to run, perform the following:

1. Using a text editor, open the $SPLUNK_HOME/etc/apps/splunk_assist/local/app.conf file for editing. On Windows systems, use %SPLUNK_HOME%\etc\apps\splunk_assist\local\app.conf as the file name. You might need to create this file.
2. Edit the file so that it looks as follows:
   

   [install]
   allows_disable = true
   

3. Save the file and close the editor.
4. Refresh or restart Splunk Enterprise.
5. Open a shell on *nix or command prompt on Windows.
6. Enter the following to disable the service:

   *nix commands	Windows commands
   cd $SPLUNK_HOME/bin ./splunk disable app splunk_assist -auth <username>:<password>	cd %SPLUNK_HOME%\bin splunk disable app splunk_assist -auth <username>:<password>

For more information on how to enable or disable an app, see Manage app and add-on objects in the Admin Manual.

You might need to manually set the environment variables that appear here for the commands to work.

Next step

Use Splunk Assist