サブスクリプションAIQueryProductivity

AI Query Assistant for Splunk

Natural-language to SPL with built-in security validation, multi-provider AI, and per-user history.

30 日間のトライアルライセンス。サインイン後すぐに発行されます。

製品概要

Operators describe an intent in plain English; AI Query Assistant translates it into an optimized SPL query. Multi-provider AI (OpenAI, Anthropic, custom presets), KV-backed query history per user, savable templates, and a security guardrail that catches dangerous time-range and SSRF patterns before they hit Splunk. Ships with full Chinese + English localization (198 i18n keys across 7 views) and works across Splunk Enterprise 10.0+, Splunk Cloud, and Search Head Cluster deployments.

主な機能

Natural-language to SPL

Operators ask in plain English; the assistant emits an optimized SPL query with caveats and field hints. The translation accepts intent ("failed logins from China today"), not just literal field names.

Multi-provider AI

Compatible with OpenAI, Anthropic / Claude, and custom presets. Provider configurations live in a KV-backed `mcp_provider_presets` collection — admins can add, rename, or remove vendors without re-installing the app.

Per-user query history

Server-side filtered by user (`{user: self.userName}` enforced in the REST handler). Survives Splunk Web restarts because history records live in the KV store, not in-process Python dicts.

Saved templates

Save and reuse common query patterns. Trial = 5 templates, Professional = 30, Enterprise unlimited. Tier-aware caps surface in the UI before you hit them.

Security guardrail

SPL validation rejects dangerous time-range patterns (the `-30mon` bug from 2.x is fixed: every relative unit s/m/h/d/w/mon/y is now anchored). SSRF guard rejects integration-platform URLs that resolve to private/loopback/link-local IP ranges.

Locked-down KV ACLs

KV collections (`mcp_ai_providers`, `mcp_license_status`, etc.) cannot be mutated outside the validating REST handlers. The legacy `debug_keys` endpoint that exposed the licence signing key was removed in 3.0.1.

RSA-PSS signed licenses

Licences carry a 2048-bit RSA-PSS signature verified locally on the customer's install. Optional AES decryption is retained for legacy issuers; new deployments verify with `public_key_pem` only — no SaaS round-trip.

Splunk Cloud + SHC

`metadata/default.meta` grants `sc_admin` alongside `admin` so KV collections work on Splunk Cloud. `default/server.conf` adds `[shclustering] conf_replication_include.mcp = true` so Setup-page edits propagate across SHC members.

エディション

以下からエディションを選んでください。ライセンスはコンソールから発行され、再インストールなしでいつでもアップグレードできます。

Starter

無料

Personal/Small team evaluation

製品サイトを見る

Professional

Enterprise

$39/月

$349/年

Large SOC/Compliance organizations

営業に問い合わせ

Professional / Enterprise をご検討ですか？営業に問い合わせ

動作環境

Splunk: 8.0+
プラットフォーム: Linux, Windows, macOS
メモリ: 4GB RAM minimum, 8GB recommended
ストレージ: 500MB available space
CPU: 2+ cores recommended