AI settings
Engine status, provider cards and the failover chain, thinking mode, semantic retrieval (embeddings), the 24-hour call trend.
AI settings is a tab of Settings and is admin-only.
Engine
The top card names the active engine: agentic (splunklib.ai Agent, the model calls read-only tools on its own) or requests fallback, with the reason for a fallback (python_too_old, splunklib_ai_missing, import_error). Features are identical; the difference is described in Requirements.
Providers
Failover is generally available from 2.0.14 (Beta before). A provider that hangs fails over after [llm] timeout_seconds, and the audit log records which provider served the request.
A primary provider plus any number of backups, failing over in order: consecutive failures (timeout, transport error, 5xx, rate limit) trip a breaker, the next provider takes over, and traffic returns once the primary recovers. Fields on each card:
| Field | Notes |
|---|---|
| Type | OpenAI-compatible. The router speaks only this protocol; Anthropic-protocol endpoints go through their compatibility layer |
| URL | Including the version path |
| Model | |
| API key | In storage/passwords; the UI shows that a key is stored and that an empty field keeps it |
| Thinking mode | Below |
| Timeout | timeout_seconds |
Test connection sends a minimal request and shows the round trip. The health view (24-hour calls, failures, P95) comes from the audit log.
Thinking mode
| Setting | Behaviour |
|---|---|
| Off (default, recommended) | Sends the parameter that disables reasoning. Every call is fixed-format JSON, so reasoning adds no accuracy. Measured on Ark, the same prompt went from 29 s to 5.8 s |
| Model default | Sends nothing |
| Low / High | Fixed level |
The parameter is translated per model family: doubao, ark- and seed map to thinking; OpenAI o-series and gpt-5 to reasoning_effort; Qwen to enable_thinking; Anthropic to thinking.budget_tokens. Unknown models (kimi, glm, minimax on Ark) get no parameter, which avoids a 400.
Semantic retrieval
An embeddings endpoint (URL, model, key; an empty key reuses the LLM's). Test connection probes the vector dimension and stores it on save. Once enabled, the knowledge base and the solutions library rank by meaning; otherwise by keyword. Switching models leaves existing vectors at the old dimension, so documents must be re-uploaded.
Call trend
A 24-hour line of calls (success and failure), P95 and tokens, from the same source as the Audit log.
Settings
Index allow-list, the three masking modes, audit forwarding, version. There is no data-source connection block; the Splunk connection is implicit inside the app.
License
Which features need a licence, requesting a trial, online and offline activation, what the fingerprint is made of, how the sealed detection engine unlocks, and what each status means.