AI Toolkit Agent Launchpad

Agent Launchpad can help you build, run, review, and manage operational agents directly in Splunk. Agent Launchpad lets you automate high-value workflows by connecting agents to your Splunk data, MCP tools, and and approved external systems, then invoking those agents from your Splunk search, saved searches, and alerts.

Use Agent Launchpad to move from manual investigation to agent-powered operational action inside Splunk.

Requirements

You must be a Splunk Cloud Platform customer running the AI Toolkit in a supported region to use the Agent Launchpad feature. See the Supported regions section for more information.

Note: On-premises users of the AI Toolkit can get Agent Launchpad through the Splunk Cloud Connect app. To learn more about this app see Agent Launchpad for on-premises users. To install this app see Splunk Cloud Connect.
You need at least 1 LLM connection in order to complete the Create Agent process. LLM connections can be added in the AI Toolkit from the Connections tab. For detailed steps see Connections in the AI Toolkit.

You must have the edit_agent_connections capability to add Knowledge Base and MCP connections. Users with the mltk_admin role have this capability by default.

Supported regions and IPs to allowlist

Agent Launchpad is only supported for customers in the following AWS regions. And for your AI Agents to function you must allowlist certain IP addresses.

The following is an example of what you can add to your stack spec using the US-east-1 IP:
JSON 
"accessRules": {
        "apiAllowlistIP": [
          "3.219.129.143/32"
        ]
      },
AWS region Location IP address for allowlist
AP-south-1 Mumbai 13.232.70.162
EU-west-1 Dublin 63.34.220.31
EU-central-1 Frankfurt 18.198.64.113
SA-east-1 Sao Paulo 18.230.120.21
US-east-1 N. Virginia 3.219.129.143
US-west-2 Oregon 44.244.241.119
AP-southeast-1 Singapore 13.213.186.218
AP-southeast-2 Sydney 52.65.76.138
AP-northeast-1 Tokyo 52.68.109.232
AP-northeast-2 Seoul 3.39.209.38
CA-central-1 Montreal 52.60.163.168
EU-west-2 London 16.61.156.166
EU-west-3 Paris 15.188.158.23
EU-south-1 Milan 15.161.176.61

Create an agentic AI Agent

Complete the following steps. All steps are required unless noted as optional:

Note: Agents are set as Private by default.

  1. Open the AI Toolkit app.

  2. From the main menu bar select Agents and then Manage agents from the drop-down.

  3. From the top right corner select +Agent. This brings up a Create Agent modal window as shown in the following image:This image shows the Create agent modal window that appears when you select the add agent button.

  4. Complete the fields on the Create Agent modal window:

    1. Provide an Agent name. Name can only include letters and numbers, no spaces or special characters.

    2. (Optional) Add a description of this new agent. Limit is 500 characters or less.

    3. Select an LLM. Splunk hosted LLMs (for Splunk Cloud customers) are supported. If you have yet to set up an LLM, you can do so through the Connections tab. For detailed steps see Connections in the AI Toolkit.

    4. Choose an LLM temperature. Default is 0.7. This value controls the randomness of the model's responses. Lower values produce a more consistent output, while higher values allow for more varied responses.

    5. Select the Max tokens value. Default is 5000. This value specifies the maximum number of tokens the model can generate in a single response. Larger values can increase response time.

    6. Select the Reasoning effort. These options control the amount of reasoning the model applies before generating a response. Choose from None, Low, Medium, or High.

  5. Select Create Agent.

  6. Your new agent now appears on the list view. The status column value changes from Creating to Available. Once the status is Available you can call the agent using ML-SPL or the Invoke Agent option.

Add Agent Skills

You can use the Agent Skills option to Create reusable instructions that can be added to agents to give them specialized capabilities.

  1. From the main menu bar select Agents and then Agent Skills from the drop-down.

  2. From the top right corner select +Skill. This brings up a Create agent skill window as shown in the following image:This image shows the Create agent skill modal window.

  3. Provide a Skill name, Description, and Skill instructions:

    1. Skill name must be alphanumeric.

    2. The description and instruction fields are text based and you can use natural language to complete.

  4. Select Save when done. The skill is then listed the Agent Skills page, and can be edited or deleted as needed.

Agent run history

You can view the agent run history from Agentic AI tab under Agent run history. You can filter the listed results by time range, Agent name, and owner.

Note: You will only see the run history of Agents for which the user is the owner, or when the Agent is shared with the role associated to the user.
The following image shows an example of the Agent run history page. Selecting any agent listed moves you into a more detailed view: The following image shows an example of the Agent run history page. Selecting any agent listed moves you into a more detailed view.

The list view includes the agent response, agent status, and date and time the agent last ran. From this list view you can select any listed agent to move into a more detailed view of what tools were called and in what order, including any steps that failed.

Conversational follow-up

When viewing the details for an agent listed on the run history page, you can use the open field at the bottom of the page for conversational follow-up about this agent and its history.

The following image shows the view when you select an Agent from the Run agent history page:

For example, "Are there any open incidents related to this agent" or "what were the other incidents related to payment gateway during the last 30 minutes of this ticket".

Select the Agent Page

When viewing the details for an agent listed on the run history page, you can select Agent Page from the top right.

The following image shows the view when you select an Agent from the Run agent history page:

This image shows the view when you select an agent from your Agent run history page. From the top right of this page you can select Agent page for an even more detailed view into this agent.

From this page your can view, edit, or delete agent settings including the Default prompt, System prompt, MCP connections, any Agent Skills used, and Invocation configurations. You can also choose to edit the agent description, deactivate the agent, or delete the agent.

This image shows an example of the page view after you select Agent Page. From this view you can edit and delete parts of the Agent and invoke the agent.

You also have the option to Invoke Agent from this page, choosing to Copy SPL or Open in Search.

About MCP connections

You can configure your AI Agent to connect to 1 or more MCP connection. Supported MCP providers are Splunk, Atlassian, Slack, PagerDuty, GitHub, and GitLab.

You can also opt for a custom MCP connection. Supported authentication methods for a custom MCP connection are Basic Auth, API key, Bearer Token, and OAuth 2.0.

Example: Using multiple MCP connections in your AI Agent

Your AI Agents can use multiple MCP connections of the same type at the same time. This means a single Agent can work across multiple environments including Splunk stacks, Jira instances, internal tool servers, and cloud or customer environments.

Support for multiple MCP connections can also make it easier to build agents that compare systems, summarize multiple environments, or route work to the correct back-end without needing separate agents for each connection.

For example, an agent can have 2 different Splunk MCP connections, each pointing to a different Splunk stack. In the following example, the Agent TestAgent007 is configured with 2 Splunk MCP connections:

Connection name Connection type Purpose
SplunkMCP MCP - Splunk Connects to one Splunk stack
SplunkMCPTolerant MCP - Splunk Connects to another Splunk stack

Both connections expose Splunk tools, but they point to different Splunk environments. The Agent can use both connections in one conversation and compare results across stacks.

Example user prompt

Can you tell me something about my splunk stacks?

Example Agent response

The Agent detects that there are 2 configured Splunk stacks and returns details for both:

Stack name Details returned
Stack 1: "faithful-falcon-3lt"

  • Version: Splunk Enterprise 10.4.2604.6

  • Architecture: Distributed cluster with 4 nodes

  • Search head: 16 cores, 125 GB RAM

  • Indexers: 3 indexers, 2 cores each, 6 GB RAM each

  • Health status: All nodes are green

  • License state: OK

  • KV Store: Ready on search head
Stack 2: "joyful-jaguar-kph"

  • Version: Splunk Enterprise 10.4.2604.6

  • Architecture: Distributed cluster with 4 nodes

  • Search head: 1 core, 6 GB RAM

  • Indexers: 3 indexers, 2 cores each, 6 GB RAM each

  • Health status: All nodes are green

  • License state: OK

  • KV Store: Ready on search head

Key observations from the Agent

  • Both stacks are running the same Splunk version: 10.4.2604.6.

  • Both stacks use a clustered indexer architecture with 3 indexers.

  • Both stacks are healthy.

  • The faithful-falcon-3lt stack has a larger search head than joyful-jaguar-kph.

  • The agent was able to inspect and summarize both Splunk stacks in a single response.

Run the AI Agent

After an agent is created and the status of that agent shows as Available, you can run that agent.

Use the following steps:

  1. From the main navigation bar select Agents and then Manage agents.

  2. Select the vertical ellipsis in the rightmost column for the agent you want to run. Choose Edit agent from the drop-down menu.

  3. This opens a more detailed view of your agent. From the top right, select Invoke Agent. Invoke Agent offers the 2 options of Copy SPL command or Open in Search:

    Invoke Agent option Description
    Copy SPL Choosing Copy SPL copies the SPL for the agent on to your clipboard. You can then paste this SPL into a new search or other point in your Splunk workflow.
    Example of copied SPL:
    CODE 
    | makeresults | aiagent prompt="Hey how are you ?" agent_name="TestAgent007"
    Open in Search Choosing Open in Search opens a new tab.
    Note:

    The new ML-SPL command of aiagent throws an error you can ignore. Select Run Query Anyway. See Search commands for machine learning safeguards.

    From this Search view you can choose to save this search and set up alerts. See the Running Agents through alerts section, Saving Searches in the Search Manual, and Create scheduled alerts in the Alerting Manual.

Running Agents though alerts

You can configure Agents as trigger actions in Splunk alerts. To configure the agents as alerts follow these steps:

  1. From the AI Toolkit app, select the Search tab.

  2. Input the SPL you want to configure as a Splunk alert.

  3. From the Save As drop-down menu, select Alert as shown in the following image:This images shows the AI Toolkit view and the Search tab. The Save As menu near the top right is highlighted.

  4. In the Alert modal, give the Alert a Title of your choosing. You must have a Title to save this alert.

  5. In the Alert modal, choose the Trigger Action of Run AI Agent as shown in the following image:This image shows the Save As Alert modal window. The Trigger Action menu is selected and the option to Run AI Agent is highlighted.

  6. Select the Agent from the Agent Name menu, and provide the Prompt. The prompt provides instructions for the AI Agent. Alert context including name, time, results, and search is automatically included.

  7. Select Save.

Run the AI Agent with ML-SPL commands

The Agent Launchpad feature ships with the new ML-SPL command of aiagent. Use this command in combination with the Agent name to run the agent on your chosen data.

The aiagent command can take in 2 parameters:

Parameter Description
prompt Task for the agent to run on. Described in natural language.
Note: This parameter is optional if you defined the task prompt during the create agent step.
agent_name Name of the agent. The name is determined when the agent is created.

The following example searches use the aiagent command:

Example 1
PYTHON 
| aiagent   
prompt="An alert has been received: {alert_description}. Fetch all relevant resources from Confluence, Jira, and related knowledge sources for this alert. Then format a summary of those resources and provide it"   
agent_name=CoolAgentName
Example 2
CODE 
| aiagent prompt="Describe a product: a red apple that weighs 182 grams, costs 0.99 dollars, and is currently in stock." agent_name="AgentApple"