Configuration
Every stanza of copilot.conf with its defaults. What the UI edits, what only the file can, and where the API key is resolved from.
The file is $SPLUNK_HOME/etc/apps/rst_splunk_ai_copilot/local/copilot.conf, overriding default/copilot.conf. The UI (AI settings, Settings, Outbound channels, MCP) writes into the same file; secrets always go to storage/passwords, never to conf. No restart is needed after editing: handlers read the conf service on every request. Only new scripted inputs (MCP, scheduled jobs) need splunk restart.
[llm]
| Key | Default | Notes |
|---|---|---|
base_url | https://ark.cn-beijing.volces.com/api/coding/v3 | OpenAI-compatible endpoint, including the version path |
model | ark-code-latest | |
api_key | empty | Plaintext fallback. Prefer AI settings, which stores it in storage/passwords |
timeout_seconds | 60 | Per request. Long tasks (investigation, platform interpretation) set their own |
max_tokens | 1024 | Features raise it where needed (explain, triage, investigate) |
temperature | 0.1 | |
response_language | auto | Language of AI output: auto follows the browser, zh or en fixed |
reasoning | off | Thinking mode: off; auto sends nothing and takes the model default; low or high fixed. Translated per model family; unknown models get no parameter |
API-key resolution order: the environment variable RST_COPILOT_LLM_API_KEY, then storage/passwords, then [llm] api_key. Additional providers and the failover chain are configured on AI settings and stored as [llm_provider:<id>] stanzas.
[masking]
| Key | Default | Notes |
|---|---|---|
mode | cloud | cloud: IPs to /24, emails keep the domain only, secrets and tokens redacted. private: IPs to /16, partial emails. airgapped: no masking, for models entirely inside the network. The environment variable RST_MASKING_MODE pins it so the UI cannot loosen it |
Masking happens before data leaves Splunk, including data the model fetches through its own tools.
[limits]
| Key | Default | Notes |
|---|---|---|
rate_per_min | 30 | AI requests per user per minute, token bucket. 0 disables |
burst | 10 | Burst ceiling |
agentic_index_whitelist | empty | Comma-separated. Constrains only the indexes the model may touch on its own; SPL the user runs is not affected. Empty means unrestricted. Also the scope of all logs on the home page and of MCP list_indexes |
[agentic]
| Key | Default | Notes |
|---|---|---|
tools_enabled | 1 | Master switch. 0 disables autonomous probing everywhere |
tools_triage to tools_detection | empty | Per-feature override (triage, nl2spl, investigate, explain, detection). Triage runs SPL per cluster and can be turned off alone on large batches |
max_tool_calls | 8 | Tool calls per turn. Past the cap, tools reply that the budget is exhausted and the model answers with the evidence it has. 0 for unlimited |
budget_seconds | 120 | Wall-clock budget per agentic turn unless the feature sets its own |
reflect_enabled, planner_enabled | 0 | splunklib.ai reflection and planning; one or two extra round-trips, off by default |
[threat_intel]
The threat-intel tool is off by default (enabled = 0). A lookup sends the raw IP, domain or hash to an external vendor and cannot be masked, so with mode = cloud it stays off even when enabled unless allow_cloud_egress = 1. endpoint is a URL template with an {indicator} placeholder, allowed_hosts an SSRF allow-list, auth_header the header carrying the key. The key lives in storage/passwords (user copilot_threatintel_api_key).
[embeddings]
Off by default. When enabled, the knowledge base ranks by meaning (rephrasings match); keyword retrieval stays as the fallback. base_url, model and api_key (empty reuses the LLM key) are set on AI settings; Test connection probes dims and stores it on save.
[license_server]
| Key | Default | Notes |
|---|---|---|
app_id | rst_splunk_ai_copilot | Do not change |
url | https://license.reallysec.com | Online activation and heartbeat |
offline_grace_days | 14 | How long the app keeps working when the licence server is unreachable |
[audit_sinks]
Audit events are always written locally to index=_internal sourcetype=copilot:audit. This stanza adds optional forwarding (metadata only, never raw logs or model output): syslog_url (tcp:// or tls://, no UDP), webhook_url with webhook_headers, tls_verify. A failing sink is logged and never blocks a request. Environment equivalents: RST_AUDIT_*.
Operations stanzas
| Stanza | Keys | Notes |
|---|---|---|
[baseline] | schedule_enabled = 0 | Daily baseline patrol. Enable after rules exist |
[usage] | monthly_token_budget = 0, token_prices, default_token_price, currency | Monthly token budget alert (0 off) and cost display. Local models without prices show tokens only |
[platform] | license_warn_pct and other thresholds | Warn and fail thresholds for each platform check |
[spl_advisor] | verify_window = -24h | Window for the before and after result-count comparison |
[onboard] | sample_rows = 50, dryrun_rows = 1000, default_app = search | Data-onboarding sampling, dry-run size, target app for apply |
[kb_sync] | enabled = 0, interval_hours = 24, kinds | Sync this instance's saved searches, lookups, macros, data models, dashboards and eventtypes into the knowledge base |
[noise] | fp_rate_threshold = 0.6, min_alerts = 10, days = 30, top_subjects = 5 | False-positive threshold and look-back for noise reduction |
[tickets] | enabled = 1, allowed_hosts, timeout_seconds = 10, verify_tls = 1 | Ticketing egress policy. SaaS domains allowed by default; on-prem hosts must be listed |
[mcp] | enabled = 0, bind = 127.0.0.1, port = 18100 | MCP server. bind accepts loopback, 0.0.0.0 and ::1 only |
[onboarding] | demo_index = rst_copilot_demo | Index the demo data lands in |
[solutions] | min_score = 0.78, min_sim = 0.25, cooldown_s = 300, top_k = 3 | Similarity floor for reusing solutions as few-shot examples. min_score calibrated on doubao-embedding-vision: rephrasings 0.81 to 0.85, unrelated 0.50 to 0.55 |
Alert source
[alerts] index defaults to notable (Enterprise Security). Instances without ES point it at their own alert index. Default field mapping: rule_name is taken from rule_name, search_name or sourcetype; urgency is taken from urgency, defaulting to medium. The same setting is editable at the top of the Alerts page.
Running in Docker
Keep the license fingerprint stable in a splunk/splunk container with a fixed machine-id, a persistent /opt/splunk/etc and a pinned MAC.
Roles and permissions
The three roles and their capabilities, which tier each feature needs, the Splunk permissions behind ES write-back and data onboarding, and how login stays Splunk's.