Known issues and limitations

Learn about current AI Canvas in Splunk beta limitations, including browser support, visualization behavior, feature constraints, and environment-specific restrictions.

As AI Canvas in Splunk is in beta, you may experience instability or unexpected behavior. The following provides a list of known issues and limitations:

  • AI Canvas in Splunk only supports Chrome and Firefox browsers.

  • Local users cannot log in to Splunk when both SAML authentication is configured.

  • If you prompt the AI Canvas assistant to add a visualization card to the board, perform other actions (such as entering more prompts and/or modifying the visualization's SPL query), then ask about the visualization, the AI Canvas assistant may give incorrect information.

  • If the AI Canvas assistant adds a visualization card to the board and you ask it to iterate on that card's SPL query, the assistant adds a new visualization card using the modified SPL query instead of updating the original visualization.

  • If you select a visualization type that is incompatible with the data source, the visualization does not render.

  • Tooltips for maps display below the canvas instead of when hovering over the map's data points.

  • Activity timeline may not function as expected.

  • AI Canvas in Splunk does not support Splunk Cross-Region Disaster Recovery (XRDR). If XRDR is enabled on the Splunk instance, AI Canvas in Splunk is deactivated.

  • Results data is limited to 100 rows per card.

  • Some commands are forbidden in AI Canvas in Splunk. You can launch a card with a forbidden command, but a Failed to execute skill... error occurs if you try to refresh or run the search.

  • If you open a report in Search, then create a card using the Save As > AI Canvas card option, it is treated as an ad hoc search, meaning that you can refresh the search or edit the SPL query. To add a report to an AI Canvas board without the option to refresh the search or edit the query, add the report from the Reports page.
  • An alert that is opened in Search and saved to a dashboard is treated as an alert. The following occurs in this scenario:
    • If there is a fired alert from the alert, the added card displays an incorrect Results from value.
    • If there are no fired alerts, the card fails to be added to a board.