Install
Install the .spl from Splunk Web or the CLI; push through the deployer on a search-head cluster; verify the engine; uninstall.
Single search head
Install the package
Splunk Web: Apps → Manage Apps → Install app from file → pick the .spl → Upload → restart.
CLI:
$SPLUNK_HOME/bin/splunk install app rst_splunk_ai_copilot-<version>-selfcontained.spl -auth admin:<password>
$SPLUNK_HOME/bin/splunk restartOr unpack into $SPLUNK_HOME/etc/apps/ and restart. The app directory is always rst_splunk_ai_copilot.
Verify
Open the app after the restart. The empty home page shows a five-item checklist: configure the LLM, activate a licence, confirm the index allow-list, load demo data (optional), ask a first question. Once all are ticked it collapses to one line.
The "Engine" card on Settings → AI settings states whether the agentic or the requests engine is running, and why, if it fell back.
Search-head cluster
Unpack the .spl into $SPLUNK_HOME/etc/shcluster/apps/rst_splunk_ai_copilot/ on the deployer and run splunk apply shcluster-bundle. Notes:
local/copilot.conf, the licence and the API key instorage/passwordsare not replicated between members. Configure each member through the UI, or shiplocal/in the deployer bundle (the key then lives in[llm] api_keyin plaintext, which is weaker thanstorage/passwords).- Licences bind to a host fingerprint, so each member activates separately; the enterprise licence has no node limit.
- The KV store replicates within the cluster, so conversations, knowledge base and triage results are the same on every member.
Splunk Cloud
Upload the fallback package (Apps → Manage Apps → Install app from file, or from Splunkbase). On Cloud:
- No agentic engine; nothing is missing, the model just does not probe on its own.
local/copilot.confcannot be edited directly; everything is configured in the UI.- The MCP server and the scripted inputs (scheduled baseline, KB sync, auto-triage) are subject to the tenant's scripted-input policy.
Uninstall
$SPLUNK_HOME/bin/splunk remove app rst_splunk_ai_copilot -auth admin:<password>KV store collections (copilot_*) and credentials in storage/passwords are not removed with the app. For a clean removal, deactivate the licence first on Settings → License (returns the online seat to the server), then drop the collections.