Search commands

Two custom search commands ship with the app (commands.conf) and work in any Splunk search bar, report or dashboard. Licence, roles, masking and audit are the same as on the home page: the commands call the backend modules directly, not over HTTP.

| copilot

| copilot "failed logins in the last 30 days by host" index=rst_demo

Generate SPL → read-only check → execute as the current user → rows become the command's output. The generated SPL is attached to the job as an info message, visible at the top of the search page.

• Results show in the Events view (Splunk's layout for a generating command with no _time column); append | table _time … for a timeline.
• The command sets its own time window (earliest= in the generated SPL) and ignores the page's time picker.
• Generation is non-deterministic: the same question may group by the host metadata field one time and by an extracted dest the next; both are correct. Copy the generated SPL to make it fixed.
• On the 1.9.0 test box | copilot takes 15–50 s including the dry run.

| splexplain

index=* | stats count by host
| splexplain

Or hand it a query:

| splexplain spl="index=* | stats count by host"

One row out: explanation (what the SPL does), risks (full-index scan, no time window, late filtering, leading wildcards), optimized_spl (the rewrite), why. Rewrites are read-only: tstats, earlier filtering, dropping index=*, fields pruning, adding a time window; never a write command.

As a streaming command on an upstream search it handles at most 20 rows per run (one model call each). The home page's "Explain this SPL" button uses the same core.

Save as Report / Alert

The "Save to Splunk" menu on a home-page answer stores the generated SPL as a saved search in the search app: a Report is unscheduled; an Alert carries a cron and a trigger, written the same way as a detection rule deployment. Analysts can save Reports; Alerts need schedule_search like rule deployment.

Permissions and audit

• Commands run with the searching user's session; invisible indexes stay invisible.
• copilot_use is enough for both; generated SPL passes the same read-only gate as the home page.
• Every call writes an audit event (via=search_command), filterable by action in Audit log.
• The commands declare python.required = 3.9, 3.13; the selfcontained package runs agentic under 3.13, otherwise the requests engine.