Smart query
Ask in one sentence. The model writes read-only SPL, dry-runs it and executes; empty results come with a reason and a fix; an offhand correction becomes a knowledge-base rule.
Smart query is the home page, available in every edition without a licence.
From question to result
- Understand: index, sourcetype, time range, grouping. The index picker sits left of the input (down to sourcetype); "auto" picks the allow-listed index with the freshest data.
- Generate SPL: the agentic engine first calls read-only tools for real field names and sample values, then writes SPL and dry-runs it with
| head 0; therequestsengine generates in one turn. The read-only check rejectsdelete / collect / outputlookup / sendemail / script / restand other write or egress commands. - Execute: the SPL runs automatically.
statsresults render as an aggregation table, events as a detail table; the card header shows index, hit count, elapsed time and the model's confidence (high: use as is; medium: expand and check the SPL; low: rephrase).
Progress shows "understand → generate → execute". One turn allows at most 8 tool calls ([agentic] max_tool_calls), after which the model answers with what it has; on the 1.9.0 test box NL → SPL takes 5–25 s, 0.4 s on a cache hit.
Input
Above the empty state: four operating stats (alerts today, open, investigations, platform issues) and six starter categories with ready questions that send on click.
- Enter sends,
Shift+Enterbreaks a line. Sending continues the conversation; "New topic" starts over. - "Last hour" in the question becomes
earliest=; with no time given, the index's data range applies. - "Drew on N verified solutions": questions asked before on the same index that returned rows are fed back as examples (the solutions library); the similarity floor is calibrated on the embedding model.
Results
| Result | Actions |
|---|---|
| Aggregation table | Click a row to drill into that group's raw events, "Back to stats" returns; export CSV; column sets are remembered per index |
| Detail table | "Explain" on a row has the model explain that event (log type, key fields, risk) |
| Generated query | Folded under "Show the generated query": edit and rerun, copy, "Open in Splunk Search", "Explain this SPL" (with optimization hints), "Save as favorite" |
| Save to Splunk | As a Report or an Alert (cron and trigger); lands in the search app's saved searches, with an open link in the toast |
Below the result: "Explain these results" summarises the batch; "Send to triage" hands the matched events to Triage; 👍 / 👎 go to the audit log, and 👎 conversations can be reviewed in Audit log.
Empty results
"Really nothing" is separated from "wrong question or data":
| Case | Sign | Handling |
|---|---|---|
| Time window | "Last hour" asked, newest data is ten days old | The index's data span is checked before the index is blamed: the range is shown with a one-click "Ask for ⟨range⟩ instead" |
| Conditions | Several conditions, zero rows | Each is relaxed in turn and "N rows without X" is listed; clicking reruns relaxed. Usually wording differs from the log (Failed password, not authentication failure) |
| Wrong index | Nothing in this one | The same conditions are tried on other allow-listed indexes; click an index name to query just that one |
| Partial multi-source | Several sourcetypes involved | Names the one that matched nothing |
Corrections
When a follow-up is a correction ("no, failed logins are sshd's Failed password"), the model distils it into a rule and a confirmation bar appears: "Remember this convention?". "Remember" writes it to the knowledge base (source correction, tied to the index / sourcetype) and it is injected into every later generation; this turn's SPL is also recorded under the previous question in its corrected form. "Ignore" does nothing.
Conventions are listed, editable and deletable under Runbooks, filtered by source "correction".
Follow-up turns
Keep asking in the same conversation: the index carries over and references like "the first one" or "that IP" resolve. Conversations live in the KV store and continue from another browser; the drop-down top-left lists history, named by the first question.
Masking
Applied before anything reaches the model, including samples the model fetches through its own tools, per the mode in Settings: cloud masks IPs to /24 (the 10.0.0.x in results) and keeps only email domains; private relaxes; air-gapped masks nothing.
UI tour
The three navigation groups and the shift they follow, the top-bar controls, the command palette, how roles affect buttons, and the three entry points outside the navigation.
Search commands
Without leaving the Splunk search bar: `| copilot` generates and runs SPL from natural language, `| splexplain` explains a query and proposes an optimized rewrite. Since 1.7.0.