Runbooks
The knowledge base: upload runbooks and SOPs as retrieval context, sync this instance's Splunk objects, the solutions library and correction rules, keyword or semantic retrieval.
Runbooks is the app's knowledge base (KV copilot_kb). The model retrieves it with search_kb while generating SPL, explaining and investigating; matching chunks enter the prompt as reference context, and correction rules are injected every time. Available in every edition.
Documents
Uploads are text (pasted or read from .md / .txt): title, body, up to 6 tags. .pdf / .docx must be converted to text first. Documents are stored in chunks; with embeddings enabled they are vectorised, otherwise keyword retrieval applies. The list filters by source: manual, Splunk object, correction.
The Search tab tries a question and shows the Top-K hits with scores (cosine with embeddings, keyword overlap without).
Sync Splunk objects (1.8.0+)
"Sync Splunk objects" teaches the knowledge base what this instance already has, one document per object (metadata.source = splunk_object):
| Kind | Captured |
|---|---|
| saved searches | Name, description, SPL, cron, app |
| lookups | Definition + fields + first 3 rows (| inputlookup; > 50 MB skipped) |
| macros | Name, definition, arguments |
| data models | Objects and fields |
| dashboards | Title + each panel's <query> |
| eventtypes / tags | Name and definition |
Idempotent by app/name; an unchanged content hash is not rewritten; Splunk's own plumbing apps are skipped. The first run samples every lookup and is slow on a large instance (minutes); later runs take seconds. [kb_sync] enabled = 1 re-syncs every 24 hours (interval_hours).
Effect: asked "failed logins in the last 7 days by host with owner", the model invented owner="unknown" before the sync; afterwards it writes | lookup asset_owner host OUTPUT owner team because it knows the lookup and its columns exist.
Solutions library
The "Solutions" tab lists (question, index, SPL) triples from Smart query that returned rows: confidence, hits, last used. Similar questions (same index, similarity ≥ [solutions] min_score) get them injected as examples, and the home page notes "Drew on N verified solutions". Rows can be disabled (no longer used as examples), deleted, or "tried on the home page". A thumbs-down demotes automatically.
Correction rules
The "correction" source filter shows conventions confirmed in Smart query ("use sshd Failed password events when counting failed logins"), tied to an index / sourcetype. Editing the text takes effect immediately; deleting stops the injection.
Permissions
Retrieval is open to viewers; upload needs analyst, sync and delete need admin, per the three tiers.
Field dictionary
Drill index → sourcetype → field with coverage, type and sample values, read live from Splunk metadata.
Asset inventory
Business context for assets and identities: Enterprise Security's asset / identity lookups or CSV import; investigations, triage and reports pick up owner and criticality automatically.