Troubleshoot with the AI Assistant in Related Content

Related Content lets you see previews of Splunk Observability Cloud data and context that are related to an event you are investigating in the Splunk Cloud Platform Search & Reporting application. To make troubleshooting easier, a generative AI experience, AI Assistant in Observability Cloud, is embedded in the Related Content panel.

When troubleshooting an application, infrastructure, or business outage, there are typically three things you need to know:

• What changed and is no longer healthy in my environment?
• Is the change related to my current Splunk Observability Cloud investigation?
• Why did it change and what do I need to fix?

To find out what changed and whether it's related to your current investigation, you can check Splunk Observability Cloud dashboards and Related Content views. To determine why the change occurred and what you need to fix requires multiple data points across multiple Splunk Observability Cloud views. The easiest way to traverse these views and data points is by using the embedded generative AI experience, Splunk AI Assistant in Observability Cloud. The AI Assistant provides immediate insights based on logs, metrics, and traces gathered from across the Splunk Observability Cloud platform, helping you to troubleshoot more quickly and reduce the mean time to resolution for an incident.

The AI Assistant provides data points along with analysis. Some responses from the AI Assistant might include links to Splunk Observability Cloud destinations that can help you verify and explore potential next steps in troubleshooting.

Prerequisites

To use the AI Assistant in Related Content, the following prerequisites must be met:

• Your organization must have Unified Identity set up.
• Your organization must have AI Assistant in Observability Cloud. (See AI Assistant in Observability Cloud.)
• Your users must have appropriate roles and capabilities in Splunk Cloud Platform.

Unified Identity

Having Unified Identity set up means that your Splunk Cloud Platform instance must be paired with a Splunk Observability Cloud organization. To pair orgs, follow the instructions in Set up Unified Identity for existing Splunk Observability Cloud customers. (Note: While Related Content works with only an API token, the AI Assistant in Related Content only works if you have set up Unified Identity.)

Required roles and capabilities in Splunk Cloud Platform

Users who want to use the AI Assistant in Related Content must have the following roles in Splunk Cloud Platform:

• o11y_access
• o11y_read_only or o11y_power or o11y_admin

Users must have the following capability in Splunk Cloud Platform: read_o11y_content. See Centralized user and role management for more information.

How to use the AI Assistant in Related Content

To use the AI Assistant to improve your troubleshooting experience, do the following:

1. Navigate to the Search & Reporting app and perform a search.

2. Select an interesting log and open the Related Content panel. See Preview observability data in the Related Content panel to learn how.

3. Select the AI Assistant tab in the Related Content panel.

4. Select from the suggested prompts:

• What is the health of the service?
• Show me troubleshooting steps.

The Assistant provides a response to the prompt you select. You can use this information to determine what action to take next.

The AI assistant is also available in Splunk Observability Cloud. See AI Assistant in Observability Cloud to learn more about the assistant as used from the observability platform, including the ability to interact in natural language.