Requirements
Splunk versions, the two packages, LLM endpoints, outbound network, browsers.
This page lists the environment conditions to confirm before installation.
Splunk
| Item | Requirement | Notes |
|---|---|---|
| Version | Splunk Enterprise 10.0 or later | The requests engine runs on every version |
| Agentic engine | 10.2 or later, Python 3.13 | The official splunklib.ai Agent exists only on this combination. Anything older falls back to the requests engine and the AI settings page states why (python_too_old, splunklib_ai_missing) |
| KV store | Enabled | Conversations, knowledge base, triage results, asset tables, reports and preferences all live there |
| Topology | Single search head or search-head cluster | Installs on the search head; nothing on indexers |
| Enterprise Security | Optional | With ES, live alerts read index=notable and verdicts write back to the notable. Without ES the alert source can be any index |
| Splunk Cloud | Not supported yet | The app's online update downloads and extracts a .spl and restarts Splunk, which would not pass Splunk Cloud vetting. There is no Cloud build |
The two packages
| Package | Contents | Use |
|---|---|---|
RST-AI-Copilot-for-Splunk-<version>-fallback.spl | Pure Python, requests engine | Splunk Enterprise where the selfcontained package cannot be used: Windows or ARM (aarch64) hosts, or environments that do not allow compiled components |
RST-AI-Copilot-for-Splunk-<version>-selfcontained.spl | splunklib.ai and dependencies bundled (about 120 MB of cp313 wheels), licence trust anchor compiled to .so | Splunk Enterprise on Linux x86_64 only; the agentic engine needs 10.2 or later |
RST-AI-Copilot-for-Splunk-<version>-splunkbase.spl | Same as the fallback package, with the in-app update off | For distribution through Splunkbase; updated through Apps > Manage Apps |
Both packages have the same features. The difference is the agentic engine: it lets the model call read-only tools to probe the real schema, dry-run its SPL and gather evidence around an alert. The requests engine answers the same prompts in one turn without probing.
A 10.2 or later host running the fallback package can later run scripts/vendor_agentic.sh on the search head to install the stack into bin/lib/, which is equivalent to the selfcontained package.
The splunkbase package differs from the fallback package in two ways only: default/copilot.conf sets [update] enabled = 0, so the in-app update is off, and app.conf sets check_for_updates = 1, so new versions show in Splunk's Manage Apps; the update card in the app is replaced by a notice. See Online update.
LLM
Any OpenAI-compatible chat-completions endpoint. Verified: Volcengine Ark coding plan (ark-code-latest, doubao-seed-*, kimi-k2.7-code, deepseek-v4-*, glm-5.3), DeepSeek, Alibaba DashScope, OpenAI, OpenRouter, local Ollama and vLLM.
| Requirement | Notes |
|---|---|
| Context of at least 32k | Investigation and triage prompts carry evidence; a short context truncates them |
| Function calling not required | The agentic engine uses splunklib.ai's own protocol |
| Embeddings endpoint optional | Semantic retrieval is off by default and the knowledge base falls back to keyword retrieval |
Network
| Direction | Target | Purpose |
|---|---|---|
| Outbound | LLM endpoint 443 | Every AI call |
| Outbound | license.reallysec.com 443 | Online activation, heartbeat, revocation list. Not needed with an offline licence |
| Outbound (optional) | Threat-intel vendor, ServiceNow and Jira, Feishu, DingTalk, WeCom, Slack, Teams, SMTP, syslog, webhook | Each egresses only once enabled in copilot.conf or in the UI; all off or unconfigured by default |
| Inbound | None | Everything goes through Splunk Web on 8000 |
The MCP server (1.9.0 and later) listens on 127.0.0.1:18100 by default. Other machines need a TLS reverse proxy in front.
Browser
The last two major versions of Chrome, Edge, Firefox and Safari. The UI is laid out for 1280 px and wider; below 1024 px the sidebar collapses.