Skip to main content
Lantern Home

 

Splunk Lantern

Getting more from Splunk AI Assistant v2 with Agent Mode and Semantic Search

  1. Last updated
  2. Save as PDF

An IT engineer types a question into Splunk AI Assistant: "What data is being collected by a certain host?" They expect a direct answer but receive SPL instead. 

Splunk AI Assistant v1 could generate and optimize SPL accurately — the gap wasn't the query; it was the experience. Users expected answers and the tool returned starting points, behaving like an autocomplete rather than a true assistant doing the work. 

Instead of handing you a query to run yourself, the assistant finds your data, applies context from your environment, and acts on your behalf. In practice, it’ll reason through your request, find the right data, build and optimize SPL, run the necessary searches, and carry out the resulting action all from a single prompt. It also surfaces existing dashboards and alerts before writing anything new, so you're never duplicating work that already lives in your environment. More specialized skills are being added continuously to cover the diversity of tasks Splunk users want to accomplish. 

What's new in Splunk AI Assistant v2

Formerly known as the Splunk AI Assistant for SPL, our new and improved 2.0 release expands the capabilities and features introduced in previous versions and continues to bring further agentic enhancements to help your team work smarter, not harder. 

This is no longer a tool just for writing SPL queries but for completing complex multi-step tasks. 

  • Agent Mode: Assistant can now take agentic actions on your behalf—run event scans, discover dashboards and alerts, execute searches, and summarize findings—with human-in-the-loop approval at every step. The AI Assistant can only read information or perform actions that the user already has access to, with no risk of accidental privilege escalation. 
  • Model Runtime Options: With v2, AI Assistant can leverage frontier models hosted in Azure. Any AI inferencing done via this method is still free. This feature includes enterprise-grade compliance and regional data boundaries. Users will still have the option to limit the model to only use Splunk-hosted models; however, doing so will disable the ability to use Agent Mode. For more information about model runtime settings, see Splunk Help. 
  • Teach AI: Admins can provide custom organizational knowledge—naming conventions, data catalog, approved data sources—via a markdown file. The Splunk AI Assistant absorbs it and applies it to every response. 
  • Expanded Tool Library: The assistant now has access to a full library of tools across retrieval, SPL execution, SPL optimization, and specialized skills. This includes the Semantic Search tool, which finds existing content like dashboards, datasets and saved searches matching the intent rather than exact keywords. 
  • Context Settings: Formerly called Personalization, this is now a more granular and transparent control panel for what environmental metadata the AI Assistant collects. 

Expanded Tool and Skill Registry

The biggest architectural shift in v2 is the move from a single-skill assistant to a multi-tool agent. The AI Assistant now has a Unified AI Tool and Skill Registry, which is a growing library of capabilities the assistant can call on to complete a task. Here is how it is organized:

Retrieval / RAG

  • retrieve_sourcetype_metadata: Your data catalog. Indexes, source types, and fields in your environment.
  • retrieve_admin_curated_knowledge: Admin-provided guidance. Local conventions, approved sources, owners.
  • retrieve_knowledge_objects: Finds existing dashboards, saved searches, reports, and alerts before writing new ones. 
  • retrieve_user_search_history: Prior SPL that worked for the requesting user. 
  • retrieve_spl_knowledge_base: Library of example SPL queries. 
  • retrieve_documentation: Official Splunk documentation lookup.

Run / validate SPL

  • splunk_search: Executes SPL over a time range. Returns results. Requires user approval. 
  • event_scan: Confirms an index/source type is producing events before running a full search.
  • splunk_spl_syntax_check: Parser-level syntax validation without execution. 

SPL optimization

  • optimize_spl_query: Performance-tunes SPL. Command ordering, index scoping, tstats improvements. 

Specialized skills

  • explain-spl: Plain-language breakdown of any SPL query. 
  • explain-concept: Splunk concept answers backed by documentation. 
  • knowledge-object-search: Guided workflow for finding existing knowledge objects.

Spotlight: Semantic Search

Create your own context dictionary with retrieve_knowledge_objects and the AI Assistant’s semantic search layer. 

Traditional Splunk search is keyword-based. If you search for "authentication failure" and your logs say auth_err or login denied, you miss them unless you already know the exact field value or source type. The burden is on the user to know the environment and correct field values for data inputs. The AI Assistant’s semantic retrieval layer maps your natural language query to conceptually related terms — deciphering intent not keyword matching. 

When you ask "what data do I have about failed logins," it surfaces relevant source types, indexes, and existing content whether those exact words appear in the metadata or not. For teams with complex, multi-team environments or inconsistent log formats, this is a core change in how discovery works. 

One of the biggest pain points in Splunk platform environments is users recreating content that already exists because they could not find it. With Semantic Search, the AI Assistant now solves that directly: if the requested information already exists in a dashboard, saved search, or alert, the assistant will find it and surface it before writing anything new.

Teach AI: Making the assistant work for your environment

Teach AI is the capability that separates a generic AI assistant from one that molds to your environment. A model that knows SPL doesn't know that your production firewall data lives in pan:traffic on the netsec index, or that your checkout pipeline index is called prod_ecom_v3, or which sources your security team has approved for investigation. That institutional knowledge lives in your team's heads, not in any training dataset. 

Admins provide a markdown file with custom organizational knowledge: your data catalog, naming conventions, approved data sources, and Agent Mode guardrails. These include specifying which indexes, source types, and tags the assistant should prioritize, restrict, or avoid entirely.  

Use case: New analyst onboarding at a financial services firm

A new SOC analyst joins a team running a complex Splunk environment that has:

  • dozens of custom indexes
  • proprietary lookup tables
  • SPL patterns that took senior analysts years to develop

Getting the new analyst to productive query writing used to take weeks. 

With Teach AI configured at onboarding, the analyst asks natural language questions and receives SPL that already knows the right index, the approved source type, and the preferred field names—all still scoped by the user's existing RBAC permissions, turning onboarding weeks into days. 

Agent Mode in action: A SOC investigation walkthrough

When Agent Mode is enabled, you enter a natural language prompt. The AI Assistant decomposes it into a list of parallel tool and skill calls, meaning that it reasons through the request the way a senior analyst would, breaking a complex task into discrete investigative steps. It runs those steps, surfaces an approval gate for any action that touches your environment, and returns a consolidated finding. 

The human-in-the-loop is not optional. Before any search executes, the AI Assistant displays the exact SPL, the time range, and the max event count it plans to use. You can see exactly what the AI Assistant intends to do, then choose to approve or deny at the level you want—the whole session at once or each search individually. The assistant will not run a search it has not shown you first. 

Demo scenario: Investigating suspicious login activity 

Here is how Agent Mode handles a real SOC investigation prompt from start to finish. 

The analyst types: Find all failed login activities in the last 24 hours and summarize what you find.

Here is what the AI Assistant does, step by step: 

  1. Retrieval: The AI Assistant calls retrieve_sourcetype_metadata and retrieve_admin_curated_knowledge to identify which indexes and source types in your environment contain authentication data. If Teach AI is configured, it uses your approved data sources directly. 
  2. Content discovery: The AI Assistant calls retrieve_knowledge_objects to check whether a dashboard or saved search for failed login monitoring already exists in your environment. If it does, it surfaces that before writing anything new. 
  3. Event scan: The AI Assistant calls event_scan to confirm the relevant index/source type is actively producing events before building a search against it. 
  4. SPL generation + optimization: The AI Assistant builds the query and passes it through optimize_spl_query and adjusts command ordering, index scoping, and stats functions for performance before execution. 
  5. Approval gate: The AI Assistant surfaces the exact SPL, time range (earliest: -24h, latest: now), and max event cap (500). You approve, deny, or select "always execute for this session." 
  6. Execution + summary: The AI Assistant calls splunk_search, runs the approved query, and returns a summarized finding—failed auth count, top source IPs, affected users, and a pattern summary—directly in the assistant window. 
  7. Next steps: The AI Assistant will provide next steps and any suggestions.

The analyst spends their cognitive load on the finding, not search mechanics. 

One important configuration note: Agent Mode requires Model Runtime to be set to option 1: "Let Splunk determine the best model based on your prompt." This allows frontier models (hosted in Azure OpenAI) to be used alongside Splunk-hosted models. Locking to Splunk-hosted models only disables Agent Mode.  

How to rebuild this demo

  1. Download or upgrade to Splunk AI Assistant 2.0 from Splunkbase. 
  2. In Settings > General, set Model Runtime to option 1: Let Splunk determine the best model based on your prompt. This is required for Agent Mode.  
  3. From the Settings > Agent Mode tab, enable Agent Mode. The first-boot consent prompt will appear. Admin must explicitly enable it as it does not turn on automatically. 
  4. Configure Context Settings to give the AI Assistant awareness of your index and source type metadata, user search logs, and knowledge objects.  
  5. Set up Teach AI with a markdown file covering your data catalog, naming conventions, approved data sources, and any Agent Mode guardrails you want to enforce. 

The bottom line

The Splunk AI Assistant v2 is a structural shift in what our assistant can do. The rename from "Splunk AI Assistant for SPL" to "Splunk AI Assistant" is the honest signal: this is not an SPL tool anymore. It is an agentic AI-powered user experience that is designed to enhance productivity, effectiveness, and overall digital resilience with the full power of the Splunk platform.

Next steps

You might find the following resources useful for implementing the guidance in this article: