Introducing Splunk AI Assistant for SPL Through a Cloud Connected Solution: On-Prem AI Without the GPU Hassle

Every aspect of daily workflows are now being supercharged with Gen AI. That’s why we’re excited to announce the general availability of Splunk AI Assistant for SPL (SAIA) through a cloud connected solution! This release extends the availability of Splunk AI Assistant for SPL from only Splunk Cloud Platform users, bringing these groundbreaking AI capabilities to Splunk Enterprise customers as well—without requiring that you manage your own GPUs. This release represents a major milestone in delivering AI-driven insights for Splunk Enterprise on-prem environments while maintaining strict compliance and security standards.

“Splunk Enterprise on-prem customers have been eager to leverage the same AI benefits that our Cloud Platform users enjoy, but they don’t want the overhead of managing GPUs,” said Hao Yang, VP of AI at Splunk. “The Splunk Enterprise AI Assistant for SPL through the cloud connected solution meets that need by offering a secure, efficient, and compliance-friendly AI solution—no GPU headaches required.”

Key Features of Splunk AI Assistant for SPL:

1. Write SPL Using Natural Language: Simplify complex SPL queries by generating them using natural language input.
2. Explain SPL Using Natural Language: Decode the intricacies of SPL queries for enhanced understanding and learning.
3. Answer Questions from Splunk Docs: Provide quick, accurate answers to technical questions sourced directly from public Splunk documentation.
4. Personalized (Optional) - You can choose to opt in or out. Opting in enables the AI Assistant for SPL to tailor responses to your data, significantly improving quality. Enabling this feature has made customers happier and is highly recommended. For more details, read the Personalization docs page.

The SPL AI Assistant transforms how you interact with your data by converting plain language into actionable SPL queries. Here are some practical ways it can help:

• Data Discovery – Quickly answer questions like “What data is being collected for host  < hostname>?"
• Security Investigations – Simplify searches, e.g., “Search for allowed network traffic from the United States by src_ip IP address.”
• Observability Investigations – Identify application issues fast with queries like “Search for exceptions and stack traces in application logs.”
• Administrative Insights – Generate SPL to manage operations such as “Show the runtime schedule of saved searches.”
• Master SPL Commands – Learn advanced techniques with prompts like “How do I enrich data with fields from a lookup  < lookupfile.csv>?”

These examples are just the start—find even more use cases on Splunk Lantern. With the SPL AI Assistant, insights are only a natural language query away. See more in lantern article for use cases for SPL AI Assistant.

How Splunk AI Assistant for SPL Through the Cloud Connected Solution Works

Splunk hosts the assistant’s proprietary AI services in Splunk Cloud Platform and moves only the necessary info required to answer each prompt—nothing more.

• GPU‑Free – You never buy, rack, or patch GPUs; Splunk handles all compute behind the scenes.
• Continuously Updated – Every model refresh and performance tweak that reaches Splunk Cloud Platform rolls out to you automatically.
• Instant Time‑to‑Value – The app is available today for supported search heads, so you can start asking natural‑language questions right after installation.

Your Top Questions

1. What data leaves my environment?

The type of data sent depends on your configuration choices. Below are the key options:

• Basic Splunk AI Assistant for SPL Setup (Minimal Data Transfer)
  At minimum, Splunk AI Assistant for SPL sends only what is required to power core functionality.
  Learn more: Splunk AI Assistant for SPL Overview
• Data Sharing for Research & Development (Optional)
  You may also opt in or out of sharing anonymized usage data to help improve the product. This also allows you to provide in-app feedback to Splunk on specific chats.
  More info: Data Sharing

2. How do I handle firewalls or proxies?

CMP customers can integrate in two common ways:

• Next‑Gen Proxy – Our onboarding journey as well as the Splunk AI Assistant for SPL settings page have proper proxy URL configuration for you to set up. 
• Whitelist Firewall – The connection is established over HTTPS (port 443) to ensure secure communication between your environment and Splunk Cloud Platform. If your Splunk Enterprise deployment is behind a firewall, you’ll need to allow outbound access to the following domain:

How to Get Started Quickly

For Splunk Enterprise customers, Splunk admins should follow these simple steps below to get started. There is a pre-download process and in-app onboarding flow: 

Pre-download process: 

1. Visit Splunkbase: Download the app from the app browser or directly from Splunkbase. 

2. Customers will need to sign special legal terms covering data use. The link for the EULA is here. The Splunkbase application will be unlocked by the AI team, and the customer will be sent an email to download the app. This process may take 72 hours to complete.

3. Customers will then install the Splunk AI Assistant for SPL application from Splunkbase or in product.

In-app onboarding process: 

4. Once you install the Splunk AI Assistant for SPL application, the app launches an in-app onboarding flow: 

• The first screen offers FAQs on use cases, data requirements, and proxy settings.
• You will then add company and tenant details. The system generates a unique tenant code.
• Now you will email the tenant code to splunkai@splunk.com. Provisioning typically takes 2–3 business days. You will then receive an activation code sent to the email address provided. At this point, the AI team will have created a tenant for you.

5. Simply add the activation code into the Splunk AI Assistant for SPL app.

6. Optionally, you can configure a proxy server. If you are not using a proxy server then you will need to make firewall changes to reach your new cloud tenant.

7. Connect to the cloud connected service.

For more information on the Splunk AI Assistant for SPL through the cloud connected solution, visit the Splunk docs today.

Looking Ahead

Splunk remains committed to broadening AI access across all deployment models so every customer—regardless of infrastructure—can unlock the transformative power of AI.

“This is just the start,” added Hao Yang. “We’re investing heavily in AI to ensure our customers can seamlessly integrate advanced AI capabilities into their operations and achieve their goals more efficiently.” 

Try it out for yourself by visiting the Splunkbase page and see how AI is making Splunk easier than ever.