AI settings
Engine status, provider cards and the failover chain, thinking mode, semantic retrieval (embeddings), the 24-hour call trend.
AI settings is a tab of Settings, admin-only.
Engine
The top card names the active engine: agentic (splunklib.ai Agent, the model calls read-only tools on its own) or requests fallback, with the reason for a fallback (python_too_old / splunklib_ai_missing / import_error). Features are identical; the difference is in Requirements.
Providers
A primary provider plus any number of backups, failing over in order: consecutive failures (timeout / transport / 5xx / rate limit) trip a breaker, the next provider takes over, and traffic returns once the primary recovers. Each card:
| Field | Notes |
|---|---|
| Type | OpenAI-compatible (the router speaks only this; Anthropic-protocol endpoints go through their compatibility layer) |
| URL | Including the version path |
| Model | |
| API key | In storage/passwords; shows "key stored, leave empty to keep" |
| Thinking mode | Below |
| Timeout | timeout_seconds |
"Test connection" sends a minimal request and shows the round trip. The health view (24-hour calls, failures, P95) comes from the audit log.
Thinking mode
| Setting | Behaviour |
|---|---|
| Off (default, recommended) | Sends the parameter that disables reasoning. Every call is fixed-format JSON, so reasoning adds nothing; measured on Ark, the same prompt went from 29 s to 5.8 s |
| Model default | Sends nothing |
| Low / High | Fixed level |
The parameter is translated per model family: doubao / ark- / seed → thinking; OpenAI o-series / gpt-5 → reasoning_effort; Qwen → enable_thinking; Anthropic → thinking.budget_tokens. Unknown models (kimi / glm / minimax on Ark) get no parameter, which avoids a 400.
Semantic retrieval
An embeddings endpoint (URL / model / key; an empty key reuses the LLM's). "Test connection" probes the vector dimension and stores it on save. Once enabled, the knowledge base and the solutions library rank by meaning; otherwise by keyword. Switching models leaves existing vectors at the old dimension, so re-upload documents.
Call trend
A 24-hour line of calls (success / failure), P95 and tokens, from the same source as the Audit log.
Settings
Index allow-list, the three masking modes, audit forwarding, version. There is no Elasticsearch-connection block: the Splunk connection is implicit inside the app.
License
Which features need a licence, self-serve trial, online and offline activation, what the fingerprint is made of, how the sealed detection engine unlocks, what each status means.