Release history

OS AI Agent versions independently of the Collectord agent and the Monitoring apps, using standard semantic versioning.

OS AI Agent is in beta and is not on Splunkbase yet; the package is available on request (see Installation). The beta build reports version 0.9.0, and this page describes it; a later beta counts up from there, and the first Splunkbase release will be 1.0.0.

0.9.0

The beta build.

• Bring your own model. Four provider kinds - OpenAI-compatible (OpenAI and every common local server), Anthropic, Azure OpenAI with key, Entra ID, or managed identity, and AWS Bedrock - with per-provider retry, circuit breaking, and ordered failover. See Providers.
• Chat. Server-side conversations run by a background worker, streaming progress, approval cards for every write, per-conversation provider and approval mode, tool cards with the exact SPL, and export to PDF, web page, Markdown, text, or a signed JSON archive that imports again. See Chat.
• Tools. Data profiling, bounded read-only search, discovery of your macros, lookups, data models, KV Store collections, users, and installed commands, and approval-gated authoring of Dashboard Studio dashboards, saved searches, reports, and alerts, grounded in an embedded copy of the SPL and Dashboard Studio references. See Tools.
• | osai. A completion, an SPL explanation, or an unattended read-only investigation from any search or scheduled report. Every run is a chat job: gated and metered like a chat turn, and readable in Chat afterwards. See The osai command.
• No process a user controls holds a provider key. The app’s roles do not carry list_storage_passwords; a key is read for the agent in a privileged context, is only ever sent to the provider it was stored for, and never follows a redirect. The read-only search tools refuse macros and savedsearch: datasets rather than run them unchecked; the license key, the activity trail and retention need a full Splunk administrator; and model output is rendered through one sanitizer that keeps text, tables, code and links and drops images, forms, media and inline styles. See Security.
• Alert investigations. The “Ask OS AI Agent” alert action, running as a named user on a token minted for the job. See Alerts and schedules.
• Query templates and situational guidance for teaching the agent your conventions.
• Cost accounting and spend limits over a rolling 24-hour window, with no bundled price list. See Costs and limits.
• An activity trail in _internal, and four dashboards: Token Usage, Activity Trail, Health, and a Conversation inspector. See Dashboards.
• A Setup page - providers, settings, guidance, query templates, and license - that is the app’s full configuration surface, which is what Splunk Cloud requires.
• Search head clustering support, with configuration replicated and each chat job run by exactly one member.
• Free tier: one provider and one user for non-commercial use, no license key required.

Requires Splunk Enterprise 9.4, 10.0, 10.2, or 10.4 on a search head with KV Store, or Splunk Cloud. See Requirements for the full compatibility matrix.

Known issues and limitations

• Per-component log levels are configuration-file only, so on Splunk Cloud the log level is raised for the whole app rather than for one component.
• Azure managed identity requires an Azure-hosted search head; it does not apply on Splunk Cloud.
• Alert investigations need token authentication, which is off by default on Splunk Enterprise.
• Right after an app upgrade without a splunkd restart, | osai may refuse to run and say the REST handlers predate the command; restart splunkd, or wait for the handler processes to recycle.