Quick start

The shortest path from the .spl to a first answered question: install the app, point it at a model, activate or request a trial, ask.

Before you start

Item	Requirement
Splunk	Splunk Enterprise 10.0+ search head with the KV store enabled. The agentic engine (autonomous evidence gathering) needs 10.2+ (Python 3.13) and the selfcontained package
Package	`rst_splunk_ai_copilot-<version>-fallback.spl` (Splunkbase / Splunk Cloud, no agentic stack) or `-selfcontained.spl` (on-prem, agentic stack bundled)
LLM	An OpenAI-compatible endpoint: URL, API key, model name (Volcengine Ark coding plan: `ark-code-latest`; DeepSeek, Qwen, Ollama and vLLM work too)
Account	Installing the app and activating a licence needs Splunk `admin` (or a role with `copilot_admin`)

Outbound traffic is two hosts: the LLM endpoint on 443 and license.reallysec.com on 443. Air-gapped sites use an offline licence and a local model and need neither, see Licence.

Install

Install the app

Splunk Web: Apps → Manage Apps → Install app from file → pick the .spl → restart. Or from the CLI:

$SPLUNK_HOME/bin/splunk install app rst_splunk_ai_copilot-<version>-selfcontained.spl
$SPLUNK_HOME/bin/splunk restart

After the restart "RST Splunk AI Copilot" appears in the app list and opens full-screen (the Splunk bar is hidden).

The empty home page shows an onboarding checklist. Its first item, "Configure the LLM", opens Settings → AI settings. Enter the URL, API key and model, click "Test connection", save. The key is stored encrypted in Splunk storage/passwords, never in a conf file.

AI settings

"Thinking mode" on the same page defaults to off: every call in this product is fixed-format JSON, so reasoning buys nothing except about 5× the latency.

Activate or request a trial

Settings → License. Paste a licence token if you have one. Otherwise enter an email and company and click "Request 14-day trial"; the licence activates as soon as it is issued. Free capabilities work without a licence; triage, investigation and detection rules do not.

License

Ask the first question

Back on the home page, pick an index (or leave "auto") and ask "failed logins in the last 30 days by host". The generated SPL runs automatically; below the result table are explain, save and send-to-triage.

First answer

With no data to try on, "Load demo data" in the checklist creates an rst_copilot_demo index (a few hundred sshd / Windows / firewall events) that can be removed with one click.

After installing

Roles: analysts get rst_copilot_analyst, read-only users get rst_copilot_viewer.
Settings: index allow-list, masking mode, audit forwarding.
With Enterprise Security installed, Incident Review already offers "Investigate with Copilot" on a notable's row menu, see Alerts.

Upgrading

Install the new .spl over the old one. Licence, conversations, knowledge base and triage results live in the KV store and storage/passwords and survive the app directory being replaced; local/copilot.conf is untouched by the installer. See Upgrade and backup.

The licence fingerprint derives from Splunk's server GUID (etc/instance.cfg) and the host's /etc/machine-id. Rebuilding the instance, changing the GUID, or losing /etc/machine-id inside a container all count as a new machine and require re-activation.

Troubleshooting

Symptom	Where to look
Blank app page	Hard-refresh the browser (Splunk Web caches static assets); `index=_internal sourcetype=splunkd component=PersistentScript copilot`
"Test connection" fails	The URL must include the version path (Ark: `…/api/coding/v3`); the key must be entitled to the model; port 443 from the search head
AI settings shows "Requests fallback"	The fallback package is installed, or Splunk < 10.2. Everything works, minus autonomous evidence gathering
Questions return `license_required`	A paid capability without a licence; if free ones fail too, check the licence page
Results are always empty	The index allow-list omits the target index; the data is outside the question's time window (the card shows the index's data range)