Activate Splunk AI Assistant in the Search app

Splunk AI Assistant is an optional generative AI feature in Splunk Web that helps you write and interpret SPL searches. The assistant is displayed on the right side of the Search bar.

Before you can use Splunk AI Assistant in your searches in Splunk Web, your Splunk administrator must activate the application by following these steps.

  1. Review and sign the End-User License Agreement (EULA) for Splunk AI Assistant. See Install or upgrade Splunk AI Assistant.
  2. Install the latest version of the Splunk AI Assistant app. The Splunk AI Assistant app version 1.3.2 or higher must be installed before you can use the AI Assistant in searches in Splunk Web. See Install or upgrade Splunk AI Assistant.
    Note: The Splunk platform instance must be restarted after installing the Splunk AI Assistant app, in order for changes to take effect.
  3. Set data sharing preferences for users in the Splunk AI Assistant app. See Configure Splunk AI Assistant.
  4. Ensure that all users who need access to Splunk AI Assistant on the search page are granted at least read permission for the Splunk AI Assistant app. See Manage knowledge object permissionsManage knowledge object permissions.
    Note: If AI assistant skills are not visible on the search page after the Splunk AI Assistant app has been activated, contact your administrator to confirm you have the necessary permissions to use the app.
Now that Splunk AI Assistant has been activated, you can start using it to help you run your searches. To open Splunk AI Assistant, click on the icon that is located to the right of the Search bar:
Screenshot of the search page with the Splunk AI Assistant icon. A window is displayed next to the icon that indicates that the app is now active and can be used to write, explain, or optimize SPL, or answer questions about Splunk Platform documentation.