Troubleshoot with the AI Assistant in Related Content
Related Content lets you see previews of Splunk Observability Cloud data and context that are related to an event you are investigating in the Splunk Cloud Platform Search & Reporting application. To make troubleshooting easier, a generative AI experience, AI Assistant in Observability Cloud, is embedded in the Related Content panel.
When troubleshooting an application, infrastructure, or business outage, there are typically three things you need to know:
- What changed and is no longer healthy in my environment?
- Is the change related to my current Splunk Observability Cloud investigation?
- Why did it change and what do I need to fix?
To find out what changed and whether it's related to your current investigation, you can check Splunk Observability Cloud dashboards and Related Content views. To determine why the change occurred and what you need to fix requires multiple data points across multiple Splunk Observability Cloud views. The easiest way to traverse these views and data points is by using the embedded generative AI experience, Splunk AI Assistant in Observability Cloud. The AI Assistant provides immediate insights based on logs, metrics, and traces gathered from across the Splunk Observability Cloud platform, helping you to troubleshoot more quickly and reduce the mean time to resolution for an incident.
The AI Assistant provides data points along with analysis. Some responses from the AI Assistant might include links to Splunk Observability Cloud destinations that can help you verify and explore potential next steps in troubleshooting.
Prerequisites
To use the AI Assistant in Related Content, you must meet the following prerequisites:
- Your organization must have Unified Identity set up. (See the next section.)
- Your organization must have AI Assistant in Observability Cloud. (See AI Assistant in Observability Cloud.)
- Your users must have appropriate roles and capabilities in Splunk Cloud Platform. (See the sections below.)
Unified Identity
Unified Identity means that your Splunk Cloud Platform instance is paired with a Splunk Observability Cloud organization. To pair orgs, follow the instructions in Set up Unified Identity for existing Splunk Observability Cloud customers.
Required roles and capabilities in Splunk Cloud Platform
Users who want to use the AI Assistant in Related Content must have the following roles in Splunk Cloud Platform:
- o11y_access
- o11y_read_only or o11y_power or o11y_admin
Users must have the following capability in Splunk Cloud Platform: read_o11y_content. See Centralized user and role management for more information.
How to use the AI Assistant in Related Content
To use the AI Assistant to improve your troubleshooting experience, do the following:
1. Navigate to the Search & Reporting app and perform a search.
2. Select an interesting log and open the Related Content panel. See Preview observability data in the Related Content panel to learn how.
3. Select the AI Assistant tab in the Related Content panel.
4. Select from the suggested prompts:
- What is the health of the service?
- Show me troubleshooting steps.
The Assistant provides a response to the prompt you select. You can use this information to determine what action to take next.
5. If you want to use natural language to interact with AI and receive further AI insights, use the AI Assistant in Observability Cloud. You can quickly open Splunk Observability Cloud by selecting any of the links to APM, Infrastructure Monitoring, or the name of a service in the Related Content panel on either the Service tab or the AI Assistant tab. See AI Assistant in Observability Cloud to learn more about the assistant as used from the observability platform, including the ability to interact in natural language.