Agent Mode in Splunk AI Assistant

Introduced with Splunk AI Assistant version 2.0.0, Agent Mode allows for agentic response generation in the assistant. Agent Mode expands Splunk AI Assistant capabilities with access to a wider set of tools, including running event scans, fetching existing dashboards, and executing searches. Agent Mode can parse a user prompt into parallel tool and skills calls, and with permission, execute searches.

CAUTION: In Agent Mode, executing non-trivial searches requires explicit permission from the user. These non-trivial searches can impact consumption and affect your SVC costs.

Requirements

You must be a Splunk Cloud Platform customer, running version 10.1.x or higher, in a supported AWS region to use Agent Mode. See the supported regions listed in the next section.

You must also opt-in for Model Runtime. On the Settings page and General tab, opt-in for Model Runtime by selecting "Let Splunk determine the best model to deliver the outcome based on your prompt (this may include models hosted outside Splunk Cloud Platform)".

Supported regions

Agent Mode is supported in the following AWS regions:

  • US West

  • US East

  • Canada Central

  • EU Frankfurt

  • EU London

  • EU Paris

  • EU Dublin

Agent Mode settings

Administrators can turn Agent Mode on or off anytime. On the Settings page and the General tab, select or de-select Enable Agent Mode as shown in the following image:

This image shows the Settings page of the AI Assistant app. The tab for General is selected and the toggle button to enable or disable Agent Mode is highlighted.

(Optional) Limit SVC consumption through roles and capabilities

To limit the risk of high SVC consumption through searches executed in the assistant, administrators have the option to create a new role, put limits on that role, and assign that role to specific users. This step isolates who can execute resource-heavy searches.

See the following to learn more:

Note: If this option does not suffice, administrators can turn off Agent Mode to prevent users from approving searches to run.

Tracking executed searches

Searches you execute using Agent Mode can be tracked by administrators through audit logs. You can also use Splunk AI Assistant to generate these metrics from the audit logs.

CAUTION: In Agent Mode, executing any search requires explicit permission from the user. These searches might have consumption impact and affect your SVC costs.

Limitation

The metrics for version 2.0.0 of Agent Mode are not available in the AI Usage Dashboard. To learn more about the usage dashboard in the Cloud Monitoring Console (CMC) see Monitor AI Assistant usage.

Beta feature: Teach AI

Agent Mode includes some default guardrails, but you can use the beta feature of Teach AI (Beta) to provide the assistant further guidance in markdown format.

Before you begin

Review the description, requirements, and provide feedback for Teach AI (Beta) in the Splunk Voice of the Customer (VOC) portal. See https://voc.splunk.com/preview/teach_splunkai

Preview disclaimer

Beta features described in this document are provided by Splunk to you "as is" without any warranties, maintenance and support, or service-level commitments. Splunk makes this Beta feature available at its sole discretion and may discontinue it at any time. Use of Beta features is subject to the Splunk Pre-Release Agreement for Hosted Services.

Teach AI settings

From the Settings page of the assistant, choose the General tab and scroll down to the Agent Mode section where you can enable the Teach AI (Beta). Example markdown has been provided, as shown in the following image:

This image shows the Settings page of the AI Assistant app. The tab for Agent mode is selected. On this tab you can add your own markdown details to help guide the assistant. An example markdown has been provided for review.

Choose Edit markdown definition to make and save any changes.

The Teach AI (Beta) section also provides a Markdown preview as shown in the following image:

This image shows the Settings page of the app. When scrolled further, you can see a Markdown preview of the markdown added to the Teach AI (Beta) sub-section.