Using the ai command with AWS Knowledge Base RAG

AWS Bedrock LLM users have the option to use an AWS Knowledge Base (KB) Retrieval-Augmented Generation (RAG) feature that transforms generic responses from the ai command into specific, actionable instructions, drawn from your own environment, procedures, and runbooks.

This feature offers the following benefits:

  • Direct integration: Connects existing AWS Bedrock LLM models directly to user-owned knowledge bases without additional infrastructure setup.

  • RAG-powered intelligence: Transforms generic AI responses into precise, context-aware insights by retrieving relevant documents from organizational knowledge before generating responses.

  • Your data, your context: Leverages uses’ specific documentation, runbooks, incident histories, and internal procedures to provide tailored, actionable guidance instead of generic suggestions.

This feature works with your existing AWS Bedrock models. Use this feature as part of your ai command SPL search by adding the kb_id command.

Requirements

You must meet the following requirements to use the ai command with AWS Bedrock LLMs:

  • You must use version 4.2.4 of the Python for Scientific computing (PSC) add-on to use this feature.

  • Customers are responsible for ingesting their own data into an AWS KB, and correctly configuring AWS IAM roles.

  • This feature is exclusive to customers using both AWS Bedrock and AWS knowledge bases.

  • Users must have the apply_ai_commander capability to use kb_id parameter with the ai command.

  • The AWS credentials you use to configure Bedrock on the Connection Management tab, must have access to the AWS knowledge base.

Obtain AWS Access and Secret Key credentials

Complete the following steps in your AWS account:

  1. Navigate to AWS Console IAM Users.

  2. Select Add users.

  3. Input a User name.

  4. Under Access type, check Programmatic access. This gives you an Access key ID and Secret access key.

AWS user access

You can either create a new IAM role or use an existing one. The IAM role must have access to AWS Bedrock models.

Use the Amazon Bedrock Limited Access policy provided by AWS and attach it to the IAM role. Once the role is set up, copy its ARN for use on the AI Toolkit Connection Management tab to set up or update settings for Bedrock models.

The following is an example ARN: arn:aws:iam::123456789012:role/role_name

For more information see the AWS managed policies documentation:

https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonBedrockLimitedAccess

Using the kb_id command

When you exclude the kb_id command in your search, the AI Toolkit can only return generic responses that are not tied to your environment.

The following is an example search without the kb_id command:This image shows an example Splunk SPL search window. The kb_id command is not part of the search.

The following SPL code is also an example search without the kb_id command: 
| inputlookup alert_entries.csv |table timestamp source message| ai prompt="find and summarize resolution specific to the Alert : {message}"

If the SPL search detected unhealthy replicator pods for example, the app results might return “Check the pods and restart if needed.” But provide no mention of bastion login, repo links, a Slack channel, or Jira tickets.

And if the search detected an Analytics-TSDB schema mismatch, the app results might return “Cassandra nodes may disagree on schema, try a restart.” But not provide Instaclustr login steps, a Jenkins link, or configuration commands.

When you include the kb_id command in your search, the AI Toolkit can return clear, step-by-step instructions with processes pulled from your company's runbooks.

The following image is an example search with the kb_id command:This image shows an example Splunk SPL search window. The kb_id command is part of the search.

The following SPL code is also an example search with the kb_id command: 
| inputlookup alert_entries.csv | table timestamp source message| ai prompt="find and summarize resolution specific to the Alert : {message}" kb_id=FZITBEFHT1
If the SPL search detected unhealthy replicator pods for example and the kb_id command is used, app results might say “Log into the bastion host, check pod health, roll the deployment using this link, and if still failing, escalate to the Replicator team on Slack and open a Jira ticket.”