AI service data in Splunk AI Assistant for SPL

Allowing access to AI service data is how you provide feedback. When you interact with the Splunk AI Assistant for SPL, Splunk may use your chat history, including inputs and outputs, context data collected from your environment as noted in this section and updated from time to time, and in-product feedback you give to develop and improve the assistant, including for Splunk research and development which may include training our models.

If you do not want to share data to be used for these purposes, you may toggle this collection off in Settings tab of the app.

How to opt in or out of sharing data for research and development

Data sharing is turned on by default. You can turn data sharing off from within Splunk AI Assistant for SPL on the Settings tab of the app. Deselect the box next to Share AI usage data with Splunk as shown in the following image:

This image shows the Settings tab of Splunk AI Assistant for SPL. A tick-box labeled as Share AI Service Data with Splunk is highlighted. From this page in the app you can choose to share or not share some data with Splunk.

What data is collected

Splunk AI Assistant for SPL collects different context data depending on if you opt-in to share data and opt-in to use the Personalization feature.

Share data

In addition to your chat history, including inputs and outputs, and in-product feedback, Splunk AI Assistant for SPL collects the following context data:

Category Description
User prompts or inputs This is the text entered into the AI assistant chat by an end-user. Examples are "Show storage freespace in winhostmon," "What data is being collected in my environment?" and "index=myindex". Source="WinEventLog:Security(Event code=123"
Grounding data This is the data processed by the AI model during the retrieval-augmented generation step to generate a relevant response to a user prompt. This includes relevant searches and contextual metadata such as index, sourcetype, and field names. Some of the data comes from the Splunk knowledge base, but if you opt into personalization, this can also come from your Splunk deployment.
Assistant responses The output generated by the AI assistant. This might contain an SPL search or a derivation of it, such as an optimized version of the search ot explanation of the search, or a summarized answer for a Splunk product question from the Splunk documentation.
Feedback Any user-entered feedback.
Service data Service data is described more fully in the Splunk Privacy Statement. Examples include "thumbs up", "thumbs down", "chat ID", "copy", "token used", and "response length".

Personalization data

Personalization is turned off by default. You can turn data sharing on or back off from within Splunk AI Assistant for SPL on the Settings tab of the app. Deselect the box next to Personalize results.

Collected data is stored in the vector DB, and a cleanup job runs weekly to delete this information if you decide to opt-out of Personalization at a later date.

Data retention

Data shared as outlined in this section is retained as set forth in the Splunk Data Retention Policy.

Chat data is stored in the KVStore on the customer's stack. If you choose to delete a chat, that chat data is deleted from your local KVStore collection.

Note: If you opt-in for the personalization feature available with version 1.0.5 and higher, that collected data is stored in the vector database. If you opt-out of personalization at a later date, a cleanup job runs weekly to delete any collected data.