Stuck on a technical hurdle? Chances are, your peers have been there, too.
We’ve compiled the live Tech Talk Q&A featuring answers to the most pressing questions from practitioners like you.
Q. Are any of these solutions available with the limited-time demo of Splunk?
A. Splunk AI Assistant is not compatible with Splunk Trial stacks.
Q. I am assuming this will also do sub-searches?
A. Yes.
You can prompt the assistant to include subsearches like "find all users from index=auth who logged in today, and use that list to search index=main for error events." If you have an existing query containing a nested subsearch, you can paste or load it into the AI Assistant and ask it to explain what the subsearch returns, how it filters the outer search, and whether it can be optimized
Q. Will Splunk AI Assistant come fully on-prem, where everything is run locally?
A. Yes, it is available for on-prem customers.
There are two options:
Cloud connect if you do not want to setup your own LLMs, and want something out of box (bonus: Splunk takes care of all the token costs)
AI tier - if you run an air-gapped environment or do not want to talk to Splunk Cloud, we have packaged all the AI Assistant backend services in docker containers that you can host it yourself (caveat: you have to provision your own GPUs to do so).
Q. Splunk AI assistant is available on-premise ?
A. Yes, through Cloud Connect or AI Tier (fully on-prem).
Q. Can you run the AI Assistant with a Developer's license if we are hosting in an air-gapped environment with the AI Tier app?
A. You might have to work with your account team, but my recommendation would be to honestly give it a shot in your real environment. You can restrict who gets to use it by using Splunk's existing RBAC control over apps.
Q. Will Splunk AI Assistant run with the Developer's License? We would like to test this on a local instance of Splunk Enterprise before rolling out to our Cloud stack.
A. Developer licenses lack the required cloud-connected AI service activation, meaning you will typically run into "Invalid activation token" or compatibility errors if you try to use it outside of a licensed commercial Splunk Cloud or Enterprise environment.
Q. We are a Splunk Cloud customer but use Splunk Enterprise installed locally for validating new apps prior to installing them on our Cloud stack. What is the recommended process to validate the Splunk AI Assistant locally before deploying it to the cloud if we do not have a Splunk Enterprise license?
A. Please reach out to us via your account team, if you want to test it on a trial stack but my recommendation would be to use it in your real stack. You can restrict access to a select group of testers via Splunk's existing RBAC over apps.
Q. Does Splunk AI Assistant support RBAC so we can roll this out on our Splunk Cloud with limited access to just a small group of users before enabling it for all users?
A. The assistant fully honors Splunk platform role-based access controls (RBAC). We also have a technical white paper that your sales contact can share with you for the details of it.
Q. What are the (minimum if known) requirements for Splunk Native solutions when running with on-premise environments? AI model and infrastructure requirements?
A. This page has all the details, specifically for hardware requirements: hardware requirements
Q. GPU and Kubernetes environments requirements when running on-premise?
A. We have provided the guide here
Q. In Splunk Cloud, Is there any resource consumption risk on the Search Head? I assume the MCP and the rest of the components—including the local Splunk LLM—are running on the Search Head. Or what alternatives should we consider to avoid impacting the rest of the Splunk components?
A. The MCP server has guardrails that admins can configure:
Tool call timeout (60 seconds by default)
Tool call limits, both global and per tool
Default row limit on search results
Allowed SPL commands, a list that controls which commands agents can run
Workload Management rules and role settings for the agent's account. These cap CPU priority, concurrent searches and how far back searches can go.
To help agents run efficient searches in the first place, they can use saia_optimize_spl to tune a query before it runs. Skills files also guide agents toward efficient SPL.
Q. What version and license levels do I need to be at to get access to agents?
A. You just need access to Splunk AI Toolkit at version 6.0 or higher along with at least one configured LLM connection in AI Toolkit.
Q. Any recommendations on best practices we can make for a better response of the agents
A. A few practices make the biggest difference:
Write a focused system prompt: the agent's role, the steps to follow, what it must never do, and the exact output format. Rules that must apply every time belong in the prompt.
Put situational know-how in skills, such as runbooks, triage methods and data dictionaries. Write each skill description as a trigger ("use when..., not for...") and keep each skill self-contained. The Splunk agent and skill templates are good starting points.
Describe your environment, for example in an index map skill that lists the indexes, sourcetypes, fields and macros to use, so the agent doesn't have to guess.
Give the agent only the tools the job needs, and ask it to back every finding with a tool result and the SPL it ran.
Feed it the right data: pipe a targeted search into | aiagent, or let it run your saved searches, instead of making it discover everything.
Keep searches bounded with time ranges and stats or head. By default, Splunk MCP search results are capped at 1,000 events and 60 seconds.
Match the model to the job: use a stronger model and a higher reasoning effort for multi-step investigations.
Iterate from Run History: read the tool calls in a few runs, change one thing at a time, and test again.
Q. Are custom agents eventually going to take the place of SOAR?
A. No. Custom agents are designed to work with SOAR, not replace it.
SOAR orchestrates security response: deterministic playbooks, hundreds of security tool integrations, case management and SLAs. When an action has to run the same auditable way every time, a playbook is the right tool.
Agent Launchpad agents add judgment on your Splunk data: investigating, enriching, triaging, summarizing and recommending. That work is hard to write as fixed playbook logic.
The two are already being connected. In a .conf26 workshop, attendees built an investigator agent and a reviewer agent on Agent Launchpad and chained them in a SOAR workflow. Letting agents hand response actions to SOAR playbooks is on our roadmap. A good rule of thumb: agents investigate and decide, and SOAR carries out the response.
Q. Regarding licensing and costs: Are Splunk's native hosted AI models (like Foundation-Sec) and Agent Launchpad fully included in our current Splunk Cloud subscription at no additional cost, or do they require separate licensing or add-on fees?"
A. Agent Launchpad is included in the AI Toolkit at no additional cost for eligible customers. There's no separate SKU or add-on, and no per-agent or per-run fee. You need AI Toolkit 6.0 or higher on a Splunk Cloud Platform stack in a supported region, and at least one supported LLM connection.
Costs to keep in mind:
Models: Splunk-hosted models (GPT-OSS 120B and 20B, and Foundation-Sec-1.1-8B-Instruct) are available to Splunk Cloud customers in the AI Toolkit. You add them as a Splunk hosted LLM connection, with no API keys or infrastructure of your own. Usage limits may apply, so your account team can confirm the current terms for your stack. If you bring your own model (OpenAI, Anthropic, Azure OpenAI or Amazon Bedrock), that provider bills you for tokens directly.
Splunk usage: the searches agents run use Splunk compute, the same as any user's searches.
Platform limits: fair-use rate and concurrency limits apply to protect the service.
Q. Can agents be given have high enough privileges to assist with admin tasks and at what threshold of autonomy have you seen potential need for caution in giving it too much control if at all?
A. Yes, with care. An agent can only do what its tools and the identity behind them allow: the account and roles behind its Splunk MCP connection, the tools you enable for that agent, and the MCP Server's own controls (role-to-tool mapping, allowed SPL commands, timeouts and rate limits).
Today agents are strongest at admin analysis, such as finding skipped or failing scheduled searches, orphaned knowledge objects, license and ingest trends and slow searches, and auditing users, roles and inputs with read-only | rest searches (Splunk MCP Server 1.3 or later). The built-in Splunk MCP tools are read-only by default, so changing anything in Splunk requires a narrowly scoped custom MCP tool.
Where we advise caution:
Read-only analysis and reporting can run unattended on a schedule or alert.
Anything that writes or changes state should be an "Approval required" tool, so a person approves each call. Approvers can also reject with guidance, and the agent re-plans.
Keep destructive or hard-to-reverse changes, such as deletes, disabling searches, or role and permission changes, human-executed.
Back admin agents with a dedicated least-privilege service account rather than a personal admin token, and share them only with admins.
Agents read log content that attackers can influence (prompt injection), which is the main reason to keep approval gates on actions.
Start with recommendations, review Run History, and automate low-risk steps once the agent has earned trust.
Q. Can the agent create scheduled reports and/or dashboards as opposed to generating new searches at run time?
A. Agents can already run your existing saved searches and reports instead of generating new SPL at run time, but creating them isn't built in: the built-in Splunk MCP Server tools that agents use are read-only by default. What you can do today:
Reuse instead of regenerate: with the Run Saved Search tool (Splunk MCP Server 1.2.1 or later), an agent runs your vetted saved searches and reports by name, with tokens and time ranges. You can also pipe a report into an agent: | savedsearch "My Report" | aiagent agent_name="myAgent" prompt="...". Each row is a separate run, so summarize with stats first if you want one answer.
Let the agent create them: an MCP Server admin can add a custom tool that calls the Splunk REST API. The MCP Server documentation includes a create_saved_search example (add cron_schedule and is_scheduled to make it a scheduled report), and dashboards can be created the same way through Splunk's data/ui/views REST endpoint. Set that tool to "Approval required" in Agent Launchpad so a person signs off before anything is created.
Schedule the agent itself: save | makeresults | aiagent agent_name="myAgent" prompt="..." as a scheduled report or alert, then email the results or write them to a lookup or summary index that a dashboard reads. Scheduling agents directly in Agent Launchpad is on our roadmap.
Q. Can Splunk agents create saved/scheduled searches/reports & dashboards?
A. Agents can already run your existing saved searches and reports instead of generating new SPL at run time, but creating them isn't built in: the built-in Splunk MCP Server tools that agents use are read-only by default. What you can do today:
Reuse instead of regenerate: with the Run Saved Search tool (Splunk MCP Server 1.2.1 or later), an agent runs your vetted saved searches and reports by name, with tokens and time ranges. You can also pipe a report into an agent: | savedsearch "My Report" | aiagent agent_name="myAgent" prompt="...". Each row is a separate run, so summarize with stats first if you want one answer.
Let the agent create them: an MCP Server admin can add a custom tool that calls the Splunk REST API. The MCP Server documentation includes a create_saved_search example (add cron_schedule and is_scheduled to make it a scheduled report), and dashboards can be created the same way through Splunk's data/ui/views REST endpoint. Set that tool to "Approval required" in Agent Launchpad so a person signs off before anything is created.
Schedule the agent itself: save | makeresults | aiagent agent_name="myAgent" prompt="..." as a scheduled report or alert, then email the results or write them to a lookup or summary index that a dashboard reads. Scheduling agents directly in Agent Launchpad is on our roadmap.
... View more
