OS AI Agent is built to be fully manageable from Splunk Web, because on Splunk Cloud nobody can open a terminal on the search head or edit a configuration file by hand. This page collects what is different there. Everything else in the documentation applies to Splunk Cloud unchanged.
Installing the beta
The app is not on Splunkbase yet, so on Splunk Cloud it installs as a private app: upload the package we send from Apps - Manage Apps - Install app from file. Splunk Cloud runs AppInspect on a private app when you upload it, and the package is built and tested against that check set. Ask sales@outcoldsolutions.com for the package and the beta license key; Installation has the rest.
Everything is on the Setup page
Every setting the app has is on its Setup page, which writes the app’s configuration files for you:
| Tab | What it manages |
|---|---|
| Providers | Add, edit, test, and delete providers; load their model list; choose the default. Every provider option - endpoint, credential, model, timeouts, context window, retry policy, prices - is on the form |
| Settings | Chat defaults (including the tools a new conversation may use), the spend limits, KV Store retention, the activity trail, and the log level |
| Guidance | The situational notes the agent adds to a request: add your own, customize or turn off a shipped one |
| Query templates | The shared library of SPL patterns the agent searches before writing its own |
| License | Enter, replace, or remove the license key, and set the free tier’s user - sc_admin only |
The only things that remain configuration-file only are the per-component log levels, the rotation of the activity trail’s log file, and the TLS settings of the app’s connection to the local splunkd, none of which a Splunk Cloud stack needs to change; see Configuration.
Who can configure it
Splunk Cloud has no admin role; its administrators hold sc_admin, which the app’s access lists include. An sc_admin can use and configure the app without being assigned an app role. Three settings stay with sc_admin whatever you delegate: the license key, the activity trail switch, and retention. To delegate, assign os_ai_agent_admin (providers, chat defaults, spend limits, the log level, guidance, templates) or os_ai_agent_user (chat and | osai) under Settings - Roles. See Security.
Providers on Splunk Cloud
A Splunk Cloud search head can only reach endpoints that are reachable from Splunk’s network, so:
- Hosted providers work as documented: OpenAI, Anthropic, Azure OpenAI with an API key or an Entra ID app registration, AWS Bedrock with a Bedrock API key or an IAM access-key pair, and hosted OpenAI-compatible services such as OpenRouter, Groq, or DeepSeek.
- A local model (Ollama or LM Studio on a laptop) is not reachable from the stack. A self-hosted model server works when it is exposed on an HTTPS endpoint the stack can reach.
- Azure managed identity does not apply: the search head is not your Azure VM. Use an API key or an Entra ID client secret instead.
Outbound access to the provider
The search head calls the provider’s endpoint over HTTPS (port 443) - api.openai.com, api.anthropic.com, <resource>.openai.azure.com, bedrock-runtime.<region>.amazonaws.com, or your own host.
Outbound connections from a Splunk Cloud stack are governed by its outbound port rules, which you manage through the Admin Config Service (ACS). If the Test button on the Providers tab reports a connection timeout while the endpoint and key are known to be good, that is the first thing to check: confirm the stack allows outbound traffic on port 443 to the provider’s host.
Alert investigations need token authentication
The “Ask OS AI Agent” alert action runs its investigation on a short-lived splunkd authentication token the app mints for the user the investigation runs as, so token authentication must be enabled on the search head. On Splunk Cloud it is on by default; the app’s health endpoint reports its state. See Alerts and schedules.
Storage and logs
Conversations, jobs, usage records, and templates live in KV Store, which Splunk Cloud provides; the Setup page’s Settings tab bounds how long conversations, jobs, usage records, and feedback are kept. Query templates stay until you delete them. The activity trail and the app’s operational logs are indexed into _internal, which you can search, and the four dashboards read them from there. The | osai command’s own log file lands in the search’s dispatch directory and is not reachable on Splunk Cloud; the search’s messages and its search.log in the Job Inspector carry the errors. Raise the log level on the Settings tab while you reproduce a problem. See Troubleshooting.