Configuration

Every stanza of copilot.conf with its defaults; what the UI edits and what only the file can; where the API key is resolved from.

The file is $SPLUNK_HOME/etc/apps/rst_splunk_ai_copilot/local/copilot.conf, overriding default/copilot.conf. The UI (AI settings, Settings, Outbound channels, MCP) writes into the same file; secrets always go to storage/passwords, never to conf. No restart after editing: handlers read the conf service on every request. Only new scripted inputs (MCP, scheduled jobs) need splunk restart.

`[llm]`

Key	Default	Notes
`base_url`	`https://ark.cn-beijing.volces.com/api/coding/v3`	OpenAI-compatible endpoint, including the version path
`model`	`ark-code-latest`
`api_key`	empty	Plaintext fallback. Prefer AI settings, which stores it in `storage/passwords`
`timeout_seconds`	`60`	Per request; long tasks (investigation, platform interpretation) set their own
`max_tokens`	`1024`	Features raise it where needed (explain / triage / investigate)
`temperature`	`0.1`
`response_language`	`auto`	Language of AI output: `auto` follows the browser, `zh` / `en` fixed
`reasoning`	`off`	Thinking mode: `off`; `auto` sends nothing and takes the model default; `low` / `high` fixed. Translated per model family; unknown models get no parameter

API-key resolution: env RST_COPILOT_LLM_API_KEY → storage/passwords → [llm] api_key. Additional providers and the failover chain are configured on AI settings and stored as [llm_provider:<id>] stanzas.

`[masking]`

Key	Default	Notes
`mode`	`cloud`	`cloud`: IPs to /24, emails keep the domain only, secrets and tokens redacted; `private`: IPs to /16, partial emails; `airgapped`: no masking, for models entirely inside the network. Env `RST_MASKING_MODE` pins it so the UI cannot loosen it

Masking happens before data leaves Splunk, including data the model fetches through its own tools.

`[limits]`

Key	Default	Notes
`rate_per_min`	`30`	AI requests per user per minute, token bucket; `0` disables
`burst`	`10`	Burst ceiling
`agentic_index_whitelist`	empty	Comma-separated. Constrains only the indexes the model may touch on its own; SPL the user runs is not affected. Empty = unrestricted. Also the scope of "all logs" on the home page and of MCP `list_indexes`

`[agentic]`

Key	Default	Notes
`tools_enabled`	`1`	Master switch; `0` disables autonomous probing everywhere
`tools_triage` … `tools_detection`	empty	Per-feature override (`triage / nl2spl / investigate / explain / detection`); triage runs SPL per cluster and can be turned off alone on large batches
`max_tool_calls`	`8`	Tool calls per turn; past the cap tools reply "budget exhausted, answer with what you have". `0` = unlimited
`budget_seconds`	`120`	Wall-clock budget per agentic turn unless the feature sets its own
`reflect_enabled` / `planner_enabled`	`0`	`splunklib.ai` reflection / planning; one or two extra round-trips, off

`[threat_intel]`

The threat-intel tool is off (enabled = 0). A lookup sends the raw IP / domain / hash to an external vendor and cannot be masked, so with mode = cloud it stays off even when enabled unless allow_cloud_egress = 1. endpoint is a URL template with an {indicator} placeholder, allowed_hosts an SSRF allow-list, auth_header the header carrying the key; the key lives in storage/passwords (user copilot_threatintel_api_key).

`[embeddings]`

Off by default. When enabled the knowledge base ranks by meaning (rephrasings match); keyword retrieval stays as the fallback. base_url / model / api_key (empty reuses the LLM key) are set on AI settings; "Test connection" probes dims and stores it on save.

`[license_server]`

Key	Default	Notes
`app_id`	`rst_splunk_ai_copilot`	Do not change
`url`	`https://license.reallysec.com`	Online activation and heartbeat
`offline_grace_days`	`14`	How long the app keeps working when the licence server is unreachable

`[audit_sinks]`

Audit events are always written locally to index=_internal sourcetype=copilot:audit. This stanza adds optional forwarding (metadata only, never raw logs or model output): syslog_url (tcp:// or tls://, no UDP), webhook_url + webhook_headers, tls_verify. A failing sink is logged and never blocks a request. Env equivalents: RST_AUDIT_*.

Operations stanzas

Stanza	Keys	Notes
`[baseline]`	`schedule_enabled = 0`	Daily baseline patrol; enable after rules exist
`[usage]`	`monthly_token_budget = 0`, `token_prices`, `default_token_price`, `currency`	Monthly token budget alert (`0` off) and cost display; local models without prices show tokens only
`[platform]`	`license_warn_pct` etc.	Warn / fail thresholds for each platform check
`[spl_advisor]`	`verify_window = -24h`	Window for the before / after result-count comparison
`[onboard]`	`sample_rows = 50`, `dryrun_rows = 1000`, `default_app = search`	Data-onboarding sampling, dry-run size, target app for "apply"
`[kb_sync]`	`enabled = 0`, `interval_hours = 24`, `kinds`	Sync this instance's saved searches / lookups / macros / data models / dashboards / eventtypes into the knowledge base
`[noise]`	`fp_rate_threshold = 0.6`, `min_alerts = 10`, `days = 30`, `top_subjects = 5`	False-positive threshold and look-back for noise reduction
`[tickets]`	`enabled = 1`, `allowed_hosts`, `timeout_seconds = 10`, `verify_tls = 1`	Ticketing egress policy; SaaS domains allowed by default, on-prem hosts must be listed
`[mcp]`	`enabled = 0`, `bind = 127.0.0.1`, `port = 18100`	MCP server; `bind` accepts loopback / `0.0.0.0` / `::1` only
`[onboarding]`	`demo_index = rst_copilot_demo`	Index the demo data lands in
`[solutions]`	`min_score = 0.78`, `min_sim = 0.25`, `cooldown_s = 300`, `top_k = 3`	Similarity floor for reusing solutions as few-shot examples (`min_score` calibrated on doubao-embedding-vision: rephrasings 0.81–0.85, unrelated 0.50–0.55)

Alert source

[alerts] index defaults to notable (Enterprise Security). Instances without ES point it at their own alert index; default field mapping is rule_name ← rule_name / search_name / sourcetype, urgency ← urgency (default medium). The same setting is editable at the top of the Alerts page.

On this page