Release history

OS AI Agent versions independently of the Collectord agent and the Monitoring apps, using standard semantic versioning.

1.0.0

Initial release.

• Chat with per-action approval. A multi-turn agent with server-side conversations, run by a background worker. In Chat, every write, and every search that uses more than Splunk’s commands that only read, pauses on an approval card you approve, deny, or edit first. See Chat.
• Bring your own model. OpenAI-compatible endpoints, local models included (Ollama, LM Studio, vLLM, llama.cpp), Anthropic, Azure OpenAI, and AWS Bedrock, with retries, failover, and Splunk’s proxy settings. See Providers.
• Dashboards and alerts it builds. Dashboard Studio dashboards, and saved searches, reports, and alerts with any installed alert action, grounded in embedded copies of the SPL and Dashboard Studio references. See Tools.
• Unattended investigations. The “Ask OS AI Agent” alert action and | osai task= investigate read-only with nobody watching, and can record a decision you define for an alert of yours to act on; | osai also answers prompts and explains SPL in any search. See Alerts and schedules and The osai command.
• Knows your deployment. It reads your macros, lookups, data models, and installed commands as the signed-in user, follows your query templates and guidance, and uses the add-on commands an administrator allows, such as Kubernetes Search or Search for AWS, for data that is in no index. See Configuration.
• Costs, limits, and an activity trail. Costs at the rates you enter, per-user and deployment-wide budgets, and one event per turn, tool call, refusal, and Setup change, read by the Token Usage, Activity Trail, and Health dashboards. See Costs and limits and Dashboards.
• Your permissions are the boundary. Every tool runs with the calling user’s own Splunk permissions, provider keys never reach a process a user controls, job credentials are encrypted at rest, and the app sends no telemetry. See Security.
• Search head clustering, an MCP server, and a free tier of one provider and one user for non-commercial use. See Licensing.

Requires Splunk Enterprise 9.4, 10.0, 10.2, 10.4, or 10.6 on a search head with KV Store, or Splunk Cloud. See Requirements.

Known issues and limitations

• Alert investigations need token authentication, which is off by default on Splunk Enterprise.
• Right after an app upgrade without a splunkd restart, | osai may refuse to run; restart splunkd, or wait for the handler processes to recycle.
• On Splunk 10.6, the KV Store logs stored values into _internal at its default log level, conversations included; see Security.
• Azure managed identity needs an Azure-hosted search head; it does not apply on Splunk Cloud.