Ask Splunk in plain language. Turns a question into SPL, explains what an existing search does, and shows what a query will return before it runs.
A 14-day trial licence, issued as soon as you sign in.
Read the hands-on evaluation
Most people who need an answer out of Splunk cannot write SPL, and the people who can spend their day writing it for everyone else.
RST AI Copilot for Splunk sits beside Splunk rather than in front of it. It translates a question into SPL, explains a search someone else wrote, and previews the fields a query will return before it touches an index. Higher editions add a knowledge base of your own searches, saved conversations, and alert triage and investigation.
Licences are issued per Splunk instance and can be moved between hosts from the console. Nothing about your data leaves the instance unless you configure it to.
Describe the question; get the search. The generated SPL is shown in full and stays editable, so it can be read, corrected and kept rather than trusted blindly.
Paste a search nobody remembers writing and get a plain-language account of what it does, which indexes it touches and what it will return.
See which fields a query will produce before it executes. Catches the empty result set and the mistyped field name while they are still cheap.
Takes a firing alert and assembles the related events, affected hosts and prior occurrences an analyst would gather by hand, so the first ten minutes are already done. Professional and above.
Your own searches, runbooks and past investigations become material the copilot draws on, so answers reflect how your estate is actually indexed. Available in every edition, no licence required.
Free
Includes
$99/user/yr
$9.9/user/mo
Includes
Pricing on request
Unlimited search heads · 12-month term
| Capability | CommunityNo licence · Free for good | ProfessionalRecommended1 search head · 12-month term | EnterpriseUnlimited search heads · 12-month term |
|---|---|---|---|
| Price | Free | $99/user/yr | Pricing on request |
| Batch alert triage with recommended action | Not included | Included | Included |
| Investigation context assembled automatically | Not included | Included | Included |
| Detection-rule drafting with ATT&CK mapping | Not included | Included | Included |
| Platform ops copilot | Not included | Included | Included |
| Alert noise reduction | Not included | Included | Included |
| Solutions library | Not included | Included | Included |
| Scheduled operations reports | Not included | Included | Included |
| Verdicts written back to Enterprise Security | Not included | Not included | Included |
| ServiceNow / Jira ticket creation | Not included | Not included | Included |
| MCP server for external AI assistants | Not included | Not included | Included |
| Audit forwarding to an external SIEM | Not included | Not included | Included |
| Multi-provider LLM failover / high availability | Not included | Not included | Included |
| Offline / air-gapped licence issuance | Not included | Not included | Included |
The free Community Edition includes all of the following, and so do Professional and Enterprise. No licence needed.
Need Enterprise, or a deployment shape not in the table? Contact sales
