UI tour
The three navigation groups and the shift they follow, the top-bar controls, the command palette, how roles affect buttons, and the three entry points outside the navigation.
The app runs full-screen inside Splunk Web with Splunk's own bar hidden. The left rail has three groups; top to bottom is the order of a shift.
Three groups
| Group | Pages | Purpose |
|---|---|---|
| Security operations | Security posture (tabs: Alerts / Reports), Smart query, Investigations, Triage, Detection rules | What is burning now → chase one thread → look back at what was asked → clear alerts in batches → turn conclusions into rules |
| Reference data | Field dictionary, Runbooks, Asset inventory, Baseline checks, Data onboarding | What you consult while handling, not what you handle today |
| Administration | Platform health (tabs: Audit log / Outbound channels / Search performance), Settings (tabs: AI settings / License / MCP) | The first is opened weekly, the second rarely after install |
Two links at the bottom: Help center (these docs) and Documentation.
Top bar
- Language: Chinese / English, reloads on switch. The AI's output language is governed separately by
response_language, which follows the UI by default. - Theme: light / dark / system.
- Account: shows the Splunk user and the role tier (admin / analyst / viewer); the menu holds only Preferences.
- ⌘K / Ctrl+K: command palette; type a page name to jump, including tab destinations; on the home page it also resets the current conversation.
How roles shape the UI
Every page is visible. Write actions follow the three role tiers: a button stays visible below the required tier and, when clicked, explains "needs analyst / admin". Paid capabilities without a licence behave the same, pointing to the licence page.
Three entry points outside the navigation
| Entry | Where | Page |
|---|---|---|
| copilot / | splexplain | Splunk search bar | Search commands |
| "Investigate with Copilot" | Enterprise Security → Incident Review → notable row menu | Alerts |
| MCP server | External agents (Claude Desktop / Cursor / your own) | MCP |
First visit
The empty home page shows an onboarding checklist (LLM / licence / index allow-list / demo data / first question); the first three items are admin-only. It collapses once complete. Its state is per user in the KV store.
Upgrade and backup
Where each kind of state lives, what survives an upgrade, how to back up and migrate, how to downgrade.
Smart query
Ask in one sentence. The model writes read-only SPL, dry-runs it and executes; empty results come with a reason and a fix; an offhand correction becomes a knowledge-base rule.