Context in Splunk AI Assistant for SPL

If you want to opt-in or out of this feature, navigate to the Settings tab of the assistant and choose the Context tab. Select or de-select the options, as shown in the following image:

Only users with administrator privileges can opt-in or opt-out of this feature. Splunk administrators can opt-in or out of Context data at any time. This setting applies at the app level, across all users, and not at the individual user level.

If you opt-out of Context data, Splunk AI Assistant cannot use the context of your data and environment in generating the response, leading to less relevant responses.

Context data works by taking the following actions:

Using the Context feature allows for the collection of some data for training and fine-tuning. For details on what data is collected see AI service data in Splunk AI Assistant.

If you opt-in for Context, collected data is stored in a Splunk database. If you opt-out of Context at a later date, a cleanup job runs weekly which deletes any collected data.

Coverage details

The Context tab includes the option to view Coverage details as shown in the following image:

On the resulting modal window, administrators can choose to Calculate coverage. This action looks at the index and sourcetype combinations in your environment over the last 7 days and checks whether Splunk AI Assistant has sampled metadata for them.

Select Calculate coverage as shown in the following image:

Selecting Calculate coverage downloads sourcetype_coverage.csv, which is a report for each index and sourcetype pair, and vector_db_collection.raw, which is the raw service response used to build that report.

Context runs the following search to gather the sourcetype metadata used for tailored results:

| tstats count where `saias_field_summary_indexes` by sourcetype index 
| dedup sourcetype, index 
| rename index as indexname, sourcetype as sourcetypename 
| map maxsearches=1000 search="| search index=\"$indexname$\" sourcetype=\"$sourcetypename$\" | `saias_field_summary_limit` | fieldsummary | eval index=\"$indexname$\", sourcetype=\"$sourcetypename$\"" 
| submitfielddata

The search consists of 2 parts:

• A tstats command to determine all of the unique index and sourcetype combinations present.
• A map subsearch which runs a fieldsummary command over each unique index and sourcetype combination. This determines what fields exist within that index and source type combination.

The following 2 macros within the search are configurable:

You can monitor the scheduled, saved searches for metadata collected by Context. Complete the following steps:

1. Open Splunk AI Assistant. Select Settings from the top navigation bar.
2. Select Searches, reports, and alerts.
3. Set the Owner filter to All.
4. To check the status of the user search logs saved searches select View Recent for the saved search or "Splunk AI Assistant - Search Logs".
5. To check the status of the metadata modular input (modinput) go to the Search tab in your Splunk instance and run the following SPL with a 24 hour lookback:
   CODECopy

   index =_internal source=/opt/splunk/var/log/splunk/splunk_ai_assistant.log "Index metadata submitted successfully"

   index =_internal source=/opt/splunk/var/log/splunk/splunk_ai_assistant.log "Index metadata submitted successfully"

   The log events that appear indicate a successful modinput execution.

   Note: These scheduled searches must not be interrupted or modified for Context data to work properly.

Consider the following before opting in for Context:

• Depending on the size of your Splunk deployment, it can take up to 2 weeks to get full coverage over the context data.

  • Turning Context off and on can extend this time delay.

• The generation speed for context results takes marginally longer than non-context results. This slight increase in generation speed allows for the search results to be specific to your environment and data.
• Saved searches that include Context data, especially those collecting source type metadata, can be expensive. You can fine-tune using the 2 provided search macros to help this.
• Saved searches that include Context data can run up against workload management rules and return partial results. Admins can double-check results of the Context data saved searches and make sure that no errors occurred while running the saved search.
• The saias_field_summary_indexes macro has a default value of "(index=" OR index=_"). This can be redefined to only select indexes that admins want to be searched by the Context data saved search for gathering source type metadata. Doing so can reduce the total surface area over which the search runs, and reduce computational costs of the saved search.