Configure Splunk AI Assistant

If you have administrator permissions you can use the Settings page of Splunk AI Assistant to adjust system settings including access to AI Service Data for training and fine-tuning, Context data to generate more relevant results, and Agent Mode to perform permitted operations on your stack.

Configure AI Service Data settings

When you use Splunk AI Assistant, Splunk uses your inputs and outputs, and any in-product feedback you give to provide the AI service and maintain and modify the assistant.

In addition to the data uses described above, you have the option of allowing Splunk to use your AI service data to train and fine-tune its AI models. This setting can only be changed by those users with write permissions for Splunk AI Assistant.

From the Settings page of Splunk AI Assistant, and the General tab, select or de-select Allow Splunk to use your AI Service Data for Training and Fine-Tuning as shown in the following image:

This image shows the Settings page and General tab of Splunk AI Assistant. A tick-box labeled as Allow Splunk to use your AI Service Data for Training and Fine-Tuning is highlighted.

To learn more about what data is collected, see AI service data in Splunk AI Assistant.

Note that unless you separately opt-in to the Use Data for Training and Fine-Tuning option, Splunk will not use your AI Service Data for Training and Fine-Tuning, which is defined as follows:

Training and Fine-Tuning means teaching or conditioning AI Models to learn patterns and perform specific tasks by supplying the AI Models with datasets and optimizing their relevant parameters. It includes adapting pre-trained AI Models to improve performance through methods such as adjusting relevant weights.

Configure Context settings

Context uses grounding metadata to generate more relevant results that are based on your unique data and environment. When you opt-in for Context the app collects non-personal data from your environment when generating results. The context data is only used within your environment.
Note: This feature was previously named Personalization.
From within Splunk AI Assistant for SPL navigate to the Settings tab and choose the Context tab.

Splunk administrators can opt-out or opt-in for Context overall or choose to specify the allowance of index and sourcetype metadata, user search logs, and knowledge objects, as shown in the following image:

This image shows the Settings page of the Assistant, and the Context tab.

If you opt-in for Context, collected data is stored in a Splunk database. If you opt-out of Context at a later date, a cleanup job runs weekly which deletes any collected data.

To learn more, see Contexti n Splunk AI Assistant.

Configure Agent Mode settings

Agent Mode expands Splunk AI Assistant capabilities and allows for agentic response generation in the assistant. As of version 2.1.0, Agent Mode is available for both Splunk Cloud and Splunk Enterprise users so long as the app is running in a supported AWS region.

Administrators can turn Agent Mode on or off anytime. On the Settings​ page and the General tab, select or de-select Enable Agent Mode​ as shown in the following image:

This image shows the Settings page of the assistant and the General tab. The section for Agent Mode is highlighted.

If an administrator does not see the option to turn Agent Mode on, you might not be running the assistant in a supported AWS region. To learn more about feature requirements see Agent Mode in Splunk AI Assistant.

Deleting data used by the assistant

Splunk AI Assistant stores the data used to power the service within the Splunk environment. To delete your AI service data, you must open a technical support ticket. Note that if you opt-in to Training and Fine-Tuning, some of your data may not be available for deletion. Generally, your data is deleted upon the de-provisioning of your Splunk Cloud Platform subscription.

Note: The assistant does not view any event information, nor does it see logs.

Chat data is stored in the KVStore on the customer's stack. If you choose to delete a chat, that chat data is deleted from your local KVStore collection.

Note: If you opt-in for Context data the collected data is stored in the vector database. If you opt-out of Context data at a later date, a cleanup job runs weekly to delete any collected data.