AI Toolkit Agent Launchpad
Agent Launchpad can help you build, run, review, and manage operational agents directly in Splunk. Create agents and reusable skills from scratch or start with Splunk-provided templates. Connect agents to your Splunk data, MCP tools, and approved external systems to automate high-value workflows, then invoke those agents from Splunk searches, saved searches, and alerts.
Use Agent Launchpad to move from manual investigation to agent-powered operational action inside Splunk.
Requirements
You must be a Splunk Cloud Platform customer running the AI Toolkit in a supported region to use the Agent Launchpad feature. See the Supported regions section for more information.
-
OpenAI
-
Anthropic
-
Azure OpenAI
-
Amazon Bedrock
-
Splunk hosted models
You must have the edit_agent_connections capability to add Knowledge Base and MCP connections. Users with the mltk_admin role have this capability by default.
Supported regions and IPs to allowlist
Agent Launchpad is only supported for customers in the following AWS regions. And for your AI Agents to function you must allowlist certain IP addresses.
"accessRules": {
"apiAllowlistIP": [
"3.219.129.143/32"
]
},| AWS region | Location | IP address for allowlist |
|---|---|---|
| AP-south-1 | Mumbai | 13.232.70.162 |
| EU-west-1 | Dublin | 63.34.220.31 |
| EU-central-1 | Frankfurt | 18.198.64.113 |
| SA-east-1 | Sao Paulo | 18.230.120.21 |
| US-east-1 | N. Virginia | 3.219.129.143 |
| US-west-2 | Oregon | 44.244.241.119 |
| AP-southeast-1 | Singapore | 13.213.186.218 |
| AP-southeast-2 | Sydney | 52.65.76.138 |
| AP-northeast-1 | Tokyo | 52.68.109.232 |
| AP-northeast-2 | Seoul | 3.39.209.38 |
| CA-central-1 | Montreal | 52.60.163.168 |
| EU-west-2 | London | 16.61.156.166 |
| EU-west-3 | Paris | 15.188.158.23 |
| EU-south-1 | Milan | 15.161.176.61 |
Agents and templates
You can create an AI agent with or without a template. Once created, agents can be edited, deleted, and triggered manually or through the use of ML-SPL.
Create a new agent
Complete the following steps to create a new agent. After you create an agent, you can edit the agent to further configure its behavior and resources, including MCP connections, Knowledge bases, Skills, and invocation configurations.
-
From the main navigation bar of the AI Toolkit app select Agents and then Agents from the drop-down menu.
-
On the resulting Manage agents page, select +Agent from the top right and then Create an agent.
-
Complete the fields on the Create Agent modal window:
-
Provide an Agent name. Name can only include letters and numbers, no spaces or special characters.
-
(Optional) Add a description of this new agent. Limit is 500 characters or less.
-
Select a supported LLM connection. See the Requirements section for the list of LLM providers supported with Agent Launchpad.
If you have yet to set up an LLM, you can do so through the Connections tab. For detailed steps see Connections in the AI Toolkit.
-
Choose an LLM temperature. Default is 0.7. This value controls the randomness of the model's responses. Lower values produce a more consistent output, while higher values allow for more varied responses.
-
Select the Max tokens value. Default is 5000. This value specifies the maximum number of tokens the model can generate in a single response. Larger values can increase response time.
-
Select the Reasoning effort. These options control the amount of reasoning the model applies before generating a response. Choose from None, Low, Medium, or High.
-
-
Select Create Agent.
-
Your new agent now appears on the Agents list view. You might see the status change from Creating to Available. Once the status is Available you can call the agent using ML-SPL or the Invoke Agent option.
Create an agent from a template
You can create an agent from a Splunk-provided agent template. Complete the following steps. All steps are required unless noted as optional:
After you create an agent, you can edit the agent to further configure its behavior and resources, including MCP connections, Knowledge bases, Skills, and invocation configurations.
-
From the main navigation bar of the AI Toolkit app select Agents and then Agents from the drop-down menu.
-
On the resulting Manage agents page, select +Agent from the top right and then Browse from template.
-
Select a template from the list view. Selecting a template opens a side drawer where you can view more details about this template including default prompt, system prompt, and skills. Select Create Agent when ready.
The following image shows the side drawer view and the Create Agent option when a template is selected:
-
Complete the 4 step agent creation wizard:
-
Step 1: Add or edit the Agent name, Agent description, and select an LLM connection from the drop-down menu. Choose an LLM temperature, select the Max tokens value, and select the Reasoning effort, just as though you were creating this agent without a template. Select Next when ready.
-
Step 2: Select the prompts you would like to include in your agent. Select Next when ready.
-
Step 3: Select or de-select Agent Skills. Select Next when ready.
-
Step 4: Select or de-select MCP connections. Select Create Agent when ready.
-
-
Your new agent now appears on the Agents list view. You might see the status change from Creating to Available. Once the status is Available you can call the agent using ML-SPL or the Invoke Agent option.
Configure and manage agents
From the Agents list view, which is available when you select Agents from the main navigation bar, and Agents from the drop-down menu, you can edit agents, view their run history, or delete the agent.
From the list view, select the icon at the far right of the row and select from the listed options as shown in the following image:
Edit agents
After you create an agent, you can edit the agent to further configure its behavior and resources. From the Agents list view, select the vertical ellipsis for the agent and select Edit agent.
From the edit view, you can add or change the following agent settings:
| Setting | Description |
|---|---|
| Default prompt | Define the default task or instructions used when the agent is invoked without another prompt. |
| System prompt | Provide instructions that guide the agent's overall behavior and how it responds. |
| LLM connection | Select the large language model connection used by the agent. |
| MCP connections | Connect the agent to external systems and select which MCP tools the agent can use. You can also configure selected MCP tools to require human approval before the agent calls them. For more information, see Require approval for MCP tool calls. |
| Knowledge bases | Add knowledge sources that the agent can use when completing tasks. |
| Agent skills | Add reusable instructions that give the agent specialized capabilities. For more information, see Skills and templates. |
| Invocation configurations | Configure how the agent can be invoked from Splunk workflows. |
Save your changes within each section you add or edit. You can return to edit the agent at any time.
Agent run history
You can view the history of your agents from the Agents tab and selecting Agent run history. You can filter the listed results by time range, Agent name, owner, or limit the list view to those agents marked as favorites.
The following image shows an example of the Agent run history page. Selecting any agent listed moves you into a more detailed view:
The list view includes the agent name, agent response, agent status, and latest agent update date and time. From this list view you can mark an agent as a favorite and select any listed agent for a detailed view of what tools were called and in what order, including any steps that failed.
Agent Page view
When you select an agent from the Agent run history list, you have an option in the top right for an Agent Page.
From this Agent Page you can edit the agent description, deactivate the agent, or delete the agent. You can also add or edit the Default prompt, System prompt, LLM connection, MCP connections, Knowledge base, Agent Skills, and Invocation configurations.
You can also trigger the agent by selecting Invoke Agent from the top right and choosing to Copy SPL command or Open in Search.
Conversational follow-up
When viewing the details for an agent listed on the Agent run history page, you can use the open field at the bottom of the page for conversational follow-up about this agent and its history.
For example, "Are there any open incidents related to this agent" or "what were the other incidents related to payment gateway during the last 30 minutes of this ticket".
The following image shows the view when you select an Agent from the Run agent history page:
Skills and templates
You can use the Skills feature to create reusable instructions that can be added to agents to give them specialized capabilities.
Create, edit, or delete a skill
Follow these steps to create a new skill, edit that skill, or delete it:
-
From the main navigation bar select Agents and then Skills from the drop-down.
-
From the top right corner select +Skill and then Create skill. This brings up a Create Skill modal window as shown in the following image:
-
Provide a Skill name, Description, and Skill instructions:
-
Skill name must be alphanumeric.
-
The description and instruction fields are text based and you can use natural language to complete.
-
-
Select Save when done. The skill is then listed on the Skills page. Listed skills can be edited or deleted.
Create a skill from a provided template
Follow these steps to create a new skill based on a Splunk-provided skills template:
-
From the main navigation bar select Agents and then Skills templates from the drop-down. Alternately, select Agents, then Skills, then select +Skill, and then Browse templates.
-
From the Skills templates page, review and select a template. Selecting a template opens a side drawer showing more details about this template. Select Copy to Skill Registry.
-
On the modal window, you can edit the fields for Skill name, Skill description, and the template instructions. Select Create Skill when ready.
-
This skill is now listed on the Skills page and can be used just like a skill created without a template, including further edits or deletion.
MCP connections
You can configure your AI Agent to use one or more MCP connections to interact with external systems and tools. Supported MCP providers include Splunk, Atlassian, Slack, PagerDuty, GitHub, and GitLab.
When you add an MCP connection to an agent, you can select which tools from that connection the agent can use. You can also use human-in-the-loop tool review to require human approval before the agent uses selected tools. Requiring approval can help you maintain oversight of sensitive actions, such as write operations, ticket creation, or calls to external systems.
You can also configure a custom MCP connection. Supported authentication methods for custom MCP connections are Basic Auth, API key, Bearer Token, and OAuth 2.0.
Require approval for MCP tool calls
After you create an agent, edit the agent and add or edit an MCP connection. When configuring the connection, you can select which MCP tools are available to the agent and which require human approval.
Human-in-the-loop tool review lets you require approval before an agent uses selected tools from an MCP connection. You configure approval requirements for each tool when you add the MCP connection to an agent. Approval settings apply to the agent you are configuring.
Complete these steps to configure tool approval requirements:
-
When creating or editing an agent, add or edit an MCP connection.
-
Select the MCP connection that you want the agent to use.
-
In the Tools list, select the tools that are available to the agent.
-
For each tool, use Approval settings to select one of the following options:
-
Approval not required: The agent can call the tool without human approval.
-
Approval required: The agent must receive human approval before calling the tool.
The following image shows the Add MCP Server connection view where you can determine if an MCP tool is used and the approval settings:
-
-
Save or add the MCP connection and complete the agent configuration.
You can also view agent threads that are paused for approval from the Overview tab in the main AI Toolkit navigation bar.
Using multiple MCP connections in your AI Agent
Your AI Agents can use multiple MCP connections of the same type at the same time. This means a single Agent can work across multiple environments including Splunk stacks, Jira instances, internal tool servers, and cloud or customer environments.
Support for multiple MCP connections can also make it easier to build agents that compare systems, summarize multiple environments, or route work to the correct back-end without needing separate agents for each connection.
For example, an agent can have 2 different Splunk MCP connections, each pointing to a different Splunk stack. In the following example, the Agent TestAgent007 is configured with 2 Splunk MCP connections:
| Connection name | Connection type | Purpose |
|---|---|---|
| SplunkMCP | MCP - Splunk | Connects to one Splunk stack |
| SplunkMCPTolerant | MCP - Splunk | Connects to another Splunk stack |
Both connections expose Splunk tools, but they point to different Splunk environments. The Agent can use both connections in one conversation and compare results across stacks.
Example user prompt
Can you tell me something about my splunk stacks?
Example Agent response
The Agent detects that there are 2 configured Splunk stacks and returns details for both:
| Stack name | Details returned |
|---|---|
| Stack 1: "faithful-falcon-3lt" |
|
| Stack 2: "joyful-jaguar-kph" |
|
Key observations from the Agent
-
Both stacks are running the same Splunk version: 10.4.2604.6.
-
Both stacks use a clustered indexer architecture with 3 indexers.
-
Both stacks are healthy.
-
The faithful-falcon-3lt stack has a larger search head than joyful-jaguar-kph.
-
The agent was able to inspect and summarize both Splunk stacks in a single response.
Run the AI Agent
After an agent is created and the status of that agent shows as Available, you can run that agent.
Use the following steps:
-
From the main navigation bar select Agents and then Agents.
-
Select the vertical ellipsis in the rightmost column for the agent you want to run. Choose Edit agent from the drop-down menu.
-
This opens a more detailed view of your agent. From the top right, select Invoke Agent. Invoke Agent offers the 2 options of Copy SPL command or Open in Search:
Invoke Agent option Description Copy SPL Choosing Copy SPL copies the SPL for the agent on to your clipboard. You can then paste this SPL into a new search or other point in your Splunk workflow. Example of copied SPL:CODE| makeresults | aiagent prompt="Hey how are you ?" agent_name="TestAgent007"Open in Search Choosing Open in Search opens a new tab. Note:From this Search view you can choose to save this search and set up alerts. See the Running Agents through alerts section, Saving Searches in the Search Manual, and Create scheduled alerts in the Alerting Manual.The new ML-SPL command of
aiagentthrows an error you can ignore. Select Run Query Anyway. See Search commands for machine learning safeguards.
Running Agents through alerts
You can configure Agents as trigger actions in Splunk alerts. To configure the agents as alerts follow these steps:
-
From the AI Toolkit app, select the Search tab.
-
Input the SPL you want to configure as a Splunk alert.
-
From the Save As drop-down menu, select Alert as shown in the following image:
-
In the Alert modal, give the Alert a Title of your choosing. You must have a Title to save this alert.
-
In the Alert modal, choose the Trigger Action of Run AI Agent as shown in the following image:
-
Select the Agent from the Agent Name menu, and provide the Prompt. The prompt provides instructions for the AI Agent. Alert context including name, time, results, and search is automatically included.
-
Select Save.
Running Agents with ML-SPL commands
The Agent Launchpad feature ships with the new ML-SPL command of aiagent. Use this command in combination with the Agent name to run the agent on your chosen data.
The aiagent command can take in 2 parameters:
| Parameter | Description |
|---|---|
prompt |
Task for the agent to run on. Described in natural language.
Note: This parameter is optional if you defined the task prompt during the create agent step.
|
agent_name |
Name of the agent. The name is determined when the agent is created. |
The following example searches use the aiagent command:
| aiagent
prompt="An alert has been received: {alert_description}. Fetch all relevant resources from Confluence, Jira, and related knowledge sources for this alert. Then format a summary of those resources and provide it"
agent_name=CoolAgentName| aiagent prompt="Describe a product: a red apple that weighs 182 grams, costs 0.99 dollars, and is currently in stock." agent_name="AgentApple"