Onboarding to AI Canvas in Splunk

To activate AI Canvas in Splunk, admins must install necessary apps and configure user access capabilities on the Splunk Cloud Platform instance.

Splunk admins must complete the following prerequisites to activate AI Canvas in Splunk on an existing Splunk Cloud Platform instance.

Eligibility requirements

The AI Canvas in Splunk app is deployed to all instances. By default, the app is deactivated since AI Canvas in Splunk is a beta feature. Only follow the onboarding instructions to activate the app if you are participating in the beta program.

Install SAIA

To use AI Canvas in Splunk, you must install Splunk AI Assistant for SPL (SAIA) 2.0 or higher on your instance.

  1. Download the SAIA app from Splunkbase.

  2. Install SAIA on your activated cloud stack. After downloading, you can install SAIA with the in-product app browser. See Install Splunk AI Assistant for SPL.

  3. In Splunk, go to Splunk AI Assistant.

  4. Go to Settings, under Stack-wide Settings, toggle on Enable Agent Mode.

  5. On the Context Settings tab, toggle on the following options:

    • Collects index, sourcetype, and field names from events in your environment. Field values are not collected.

    • Collects searches run by users in your environment. Only includes searches previously run by the requesting user.

    • Collects knowledge objects from your environment, including macros, data models, lookups, dashboards, reports, and alerts.

Note: If you are not able to install the SAIA app, this is likely because you have not signed the required legal terms to access SAIA or your request for app access has not yet been processed.

Install Splunk MCP Server

To use AI Canvas in Splunk, you must install the Splunk Model Context Protocol (MCP) Server app 1.1.2 or higher on your instance.

  1. Download the Splunk MCP Server app from Splunkbase.

  2. Install Splunk MCP Server on your activated cloud stack. After downloading, you can install Splunk MCP Server with the in-product app browser. See Configure the Splunk MCP Server.

Submit a request to activate AI Canvas in Splunk

To activate AI Canvas in Splunk, you must accept the End User License Agreement, then request AI Canvas activation on your Splunk instance in the Splunk Voice of the Customer portal. AI Canvas is activated on all single instance nodes and all standalone search heads. AI Canvas cannot be activated on search head clusters. After receiving your request, the Splunk team activates AI Canvas in Splunk on your instance.

User access configuration

All users, including admins and non-admins, require the following capabilities to access AI Canvas in Splunk. The Splunk admin has both capabilities by default. For non-admin users, the Splunk admin can add the capability to the appropriate user roles to grant access.

  • mcp_tool_execute

  • show_ai_canvas