The short version: a Splunk search head with KV Store, a network route from it to the LLM provider you choose, and an API key or an endpoint that needs none. The details below are the full picture.
Splunk
| Splunk Enterprise | 9.4, 10.0, 10.2, 10.4, and 10.6 (tested). On 10.6, read Splunk 10.6: KV Store values in _internal first |
| Splunk Cloud | Supported - see Splunk Cloud for what is different there |
| Install location | Search head only |
| KV Store | Required - conversations, jobs, usage records, and templates live there |
| Search head clustering | Supported; one member runs each chat job, and the configuration replicates |
| Token authentication | Required for alert-triggered investigations and for scheduled | osai task= searches that name a run_as user (Settings - Tokens; on by default on Splunk Cloud, off by default on Splunk Enterprise) |
There is no indexer or forwarder component, and the app keeps its binaries and its own os_ai_agent.conf out of the knowledge bundle Splunk replicates to search peers; its field extractions and lookup definitions replicate as usual. The app’s activity trail lands in _internal through Splunk’s own default monitor, and everything else it keeps is KV Store. It writes to an index of yours only when you configure decisions, and then to the index you name.
Search head platform
The bundled binary ships for these search-head operating systems and architectures:
- Linux: amd64, arm64
- Windows: amd64
- macOS: amd64, arm64
A provider
One of:
- An OpenAI-compatible endpoint - OpenAI, or any server that exposes
/v1/chat/completions: Ollama, LM Studio, vLLM, llama.cpp, DeepSeek, Groq, xAI, Mistral, OpenRouter, Together, Fireworks, and others. - Anthropic - the native Messages API.
- Azure OpenAI - an API key, an Entra ID app registration, or a managed identity on an Azure-hosted search head.
- AWS Bedrock - the Converse API, with a Bedrock API key or an IAM access-key pair.
The model must support tool calling for the agent to do anything beyond answering questions; every hosted model above does, and so do the common local models. See Providers.
Network
Outbound HTTPS from the search head to the provider’s endpoint - api.openai.com, api.anthropic.com, your Azure resource, bedrock-runtime.<region>.amazonaws.com, or the host running your local model. The search head is what connects to the provider, so firewall rules and proxies apply there: provider requests follow the proxy Splunk is configured with ([proxyConfig] in server.conf), and a model elsewhere on your network goes through it unless no_proxy lists it - see Providers. Nothing else leaves your environment: the app sends no telemetry.
Licensing
The free tier needs no key: one provider, one user, for non-commercial use. A paid license lifts the provider cap, enables every user who holds the app’s capability, and covers commercial use. See Licensing.