The short version: a Splunk search head with KV Store, a network route from it to the LLM provider you choose, and an API key or an endpoint that needs none. The details below are the full picture.
Splunk
| Splunk Enterprise | 9.4, 10.0, 10.2, and 10.4 (tested) |
| Splunk Cloud | Supported; during the beta the package installs as a private app - see Splunk Cloud for what is different there |
| Install location | Search head only |
| KV Store | Required - conversations, jobs, usage records, and templates live there |
| Search head clustering | Supported; one member runs each chat job, and the configuration replicates |
| Token authentication | Required for alert-triggered investigations and for scheduled | osai task= searches that name a run_as user (Settings - Tokens; on by default on Splunk Cloud, off by default on Splunk Enterprise) |
There is no indexer or forwarder component. The app writes nothing to a custom index: its activity trail lands in _internal through Splunk’s own default monitor, and everything else is KV Store.
Search head platform
The bundled binary ships for these search-head operating systems and architectures:
- Linux: amd64, arm64
- Windows: amd64
- macOS: amd64, arm64
A provider
One of:
- An OpenAI-compatible endpoint - OpenAI, or any server that exposes
/v1/chat/completions: Ollama, LM Studio, vLLM, llama.cpp, DeepSeek, Groq, xAI, Mistral, OpenRouter, Together, Fireworks, and others. - Anthropic - the native Messages API.
- Azure OpenAI - an API key, an Entra ID app registration, or a managed identity on an Azure-hosted search head.
- AWS Bedrock - the Converse API, with a Bedrock API key or an IAM access-key pair.
The model must support tool calling for the agent to do anything beyond answering questions; every hosted model above does, and so do the common local models. See Providers.
Network
Outbound HTTPS from the search head to the provider’s endpoint - api.openai.com, api.anthropic.com, your Azure resource, bedrock-runtime.<region>.amazonaws.com, or the host running your local model. The search head is what connects to the provider, so firewall rules and proxies apply there. Nothing else leaves your environment: the app sends no telemetry.
Licensing
The free tier needs no key: one provider, one user, for non-commercial use. A paid license lifts the provider cap, enables every user who holds the app’s capability, and covers commercial use. See Licensing.