Settings
Index allow-list, the three masking modes, audit forwarding, version. There is no data-source connection block; the Splunk connection is implicit inside the app.
Settings is admin-only; its tab family includes AI settings, License and MCP. Changes collect in the save bar at the bottom; Save and apply writes local/copilot.conf with no restart.
Data access
| Item | Key | Notes |
|---|---|---|
| Index allow-list | [limits] agentic_index_whitelist | Comma-separated. Bounds what the model may touch on its own, the home page's all-logs scope and MCP list_indexes. SPL the user writes is not affected, and Splunk role permissions remain the floor. Empty means unrestricted |
| Masking mode | [masking] mode | cloud: IPs to /24, email domain only, secrets and tokens redacted. private: IPs to /16. airgapped: nothing. Read-only here when RST_MASKING_MODE pins it |
Masking runs before data leaves Splunk, including samples the model fetches through tools and the per-cluster history triage looks up.
Audit forwarding
[audit_sinks]: syslog address (tcp://host:601 or tls://host:6514), webhook URL and headers (headers echo back as <set · N chars>), TLS verification. The local _internal audit is unaffected.
Version
Shows the current version and build and checks for an online update: the app reads a signed update manifest from the GitHub Release, and when a newer version exists the button reads Update to X. Clicking it downloads the package, verifies the signature, backs up the current version and installs; click Restart Splunk now to finish. It needs install_apps / edit_local_apps and restart_splunkd. On a search-head cluster member the card points to the deployer instead. The splunkbase package has the in-app update off by default; the card shows a notice instead, and new versions are installed from Splunk's Apps > Manage Apps. See Upgrade and backup.
File-only settings
Rate limits ([limits] rate_per_min, burst), agentic budget ([agentic]), threat intel ([threat_intel]) and the operations-layer thresholds are in Configuration.
Outbound channels
Feishu, DingTalk, WeCom, Slack, Teams, email, webhook and other channels routed by severity, delivery records with retry, report schedule, and ticketing (ServiceNow, Jira) configuration.
AI settings
Engine status, provider cards and the failover chain, thinking mode, semantic retrieval (embeddings), the 24-hour call trend.