About the AI Toolkit

Machine learning is a process for generalizing from examples. These generalizations, typically called models, can be used for tasks such as predicting the value of a field, forecasting future values, identifying patterns in data, and detecting anomalies in new data.

The AI Toolkit provides tools for building and operationalizing machine learning and AI workflows in Splunk. Use the AI Toolkit to create, validate, manage, and operationalize machine learning models through guided workflows, connect to large language models (LLMs), and build and run agentic AI agents that can interact with your Splunk data and approved external systems.

The Overview page provides a summary of recent AI Agent activity and items that require your attention.

CAUTION: The AI Toolkit is not a default solution, but a way to create custom machine learning. Domain knowledge, Splunk Search Processing Language (SPL) knowledge, Splunk platform experience, and data science skills or experience, are all valuable when using the toolkit.

AI Toolkit features

The following features are available in the AI Toolkit:

  • Agent Launchpad for building, configuring, running, and reviewing agentic AI agents in Splunk. Create agents and reusable skills from scratch or use Splunk-provided templates, connect agents to Splunk data and supported external systems through MCP connections, and configure human approval for selected MCP tool calls. Agents can be invoked from Splunk searches, saved searches, and alerts. For more information, see AI Toolkit Agent Launchpad.

  • Connections to supported large language models (LLMs) for incorporating generative AI capabilities into Splunk workflows. Configure supported LLM providers and models from the Connections page. For more information, see Connections in the AI Toolkit.

  • Guided modeling Assistants to manage your data source, selected algorithm, and any additional parameters used to configure that algorithm. Assistants bring all aspects of a monitored machine learning pipeline into one interface and include automated model versioning and lineage. Each Assistant offers a choice of algorithms to fit and apply a model, with visualizations to help you interpret the results. Assistants are used with your own data and generate Splunk Search Processing Language (SPL) for you. For further information about Assistant options, see the Experiment Assistant overview and Smart Assistant overview.
  • Machine learning algorithms, including over 30 common algorithms and access to more than 300 popular open-source algorithms through the Python for Scientific Computing library. For more information on the available algorithms, see Algorithms in the AI Toolkit.
  • SPL search command extensions for performing machine learning analytics on your data, including fitting and applying models, and managing learned models. For more information about SPL search command extensions, see Search commands for machine learning.
  • Custom visualizations for viewing and analyzing data in formats designed to support machine learning workflows. For more information on information graphics, see Custom visualizations in the AI Toolkit.

  • A Showcase of different sample datasets to help new users explore machine-learning concepts. Each end-to-end example pre-populates a guided modeling Assistant to demonstrate how to perform different types of machine learning analysis and prediction using best practices, including what the ideal results look like when you're using your own data. Filter the available Showcases by machine learning operation or industry to see the examples that best match your machine learning goals. For a detailed look at the Showcases, see Showcase examples.

Getting started with the Splunk platform

If you are a new user to the Splunk platform, familiarize yourself with the product by working through the Search Tutorial. The Search Tutorial helps you learn what the Splunk platform does and provides step-by-step walk-throughs on how to set up an instance of the platform, ingest data, perform searches, save and share reports, and create dashboards.

For more information, see the Search Tutorial in the Splunk Enterprise manual.

Getting started with the AI Toolkit

If you are new to the AI Toolkit, explore interactive machine learning examples that step you through the entire process for IT, security, business, and IoT use cases by reviewing the Showcase examples. Each Showcase uses different sample datasets to help new users explore machine learning concepts. The end-to-end examples pre-populate an Assistant to demonstrate how to perform different types of machine learning analysis and prediction using best practices, including what the ideal results look like when you use your own data.

For more information, see the AI Toolkit Showcase.

AI Toolkit navigation bar

Select from the following tabs in the AI Toolkit main navigation bar:

Tab name Description
Overview View a summary of recent AI Agent activity, including recent runs, run status, and threads paused for human approval. Use this page to quickly review agent activity and access items that require your attention.
Experiments A knowledge object in the Splunk platform that keeps track of settings and history, as well as affiliated alerts and scheduled trainings.
Models Models: Access any models that you created using the fit command. The model name, algorithm used, and sharing settings are visible.

Settings: Users with administrator access can configure the fit and apply command settings and make changes for all algorithms or for an individual algorithm. Default settings apply to each algorithm unless otherwise changed. Changing settings can impact app performance.
Agents

Agents: Configure AI agents.

Agent run history: See what tools were called and in what order. Choose to mark any agent as a favorite.

Agent templates: Configure an AI agent based on a Splunk-provided template.

Skills: Create reusable instructions for your agents.

Skills template: Create reusable instructions for your agents based on a Splunk-provided template.
Connections Connections: Create LLM, MCP, knowledge base, and container connections to the AI Toolkit.

Container Management: Make external runtime connections. View and manage the listed containers and can take actions including START, STOP, DELETE, and VIEW LOGS.
Search Use your SPL knowledge to perform machine learning analytics on your chosen data.
Alerts View and manage alerts created in the AI Toolkit.
Support Docs: Read AI Toolkit documentation.

Video Tutorials: View videos about the AI Toolkit.

Showcase: End-to-end examples that pre-populate the chosen Assistant with a sample dataset and demonstrate the results.