OS AI Agent

OS AI Agent is an AI assistant that runs inside Splunk, with the model you choose. Point it at the provider you already pay for, or at a model on your own hardware, and ask in plain English: it explores your indexes, writes and verifies SPL, shows every search it ran, and answers with the numbers. Bring your own model. Any OpenAI-compatible endpoint (OpenAI, DeepSeek, OpenRouter, Groq, and local servers such as LM Studio, Ollama, vLLM or llama.cpp), Anthropic, Azure OpenAI and AWS Bedrock, with retries, failover between providers, prompt caching and Splunk's proxy settings. A local model on your laptop costs nothing per question. It builds, with your approval. Ask for a Dashboard Studio dashboard, a report or an alert. In Chat, anything that writes pauses on an approval card that shows exactly what will be created; approve it, deny it with a reason, or edit it first. It investigates when you are not watching. The "Ask OS AI Agent" alert action and the `| osai` command run read-only investigations from alerts and scheduled searches, and can record a decision, from answers you define, as an event your next alert can act on. **It knows your deployment.** It reads your macros, lookups, data models and installed commands as the signed-in user, follows your query templates and situational guidance, and uses the add-on commands an administrator allows, such as Kubernetes Search or Search for AWS, for data that is in no index. It runs as you. Every tool runs with the calling user's own Splunk permissions, provider keys stay in Splunk's credential store, and an activity trail records every turn, tool call, refusal and configuration change. Token Usage, Activity Trail and Health dashboards show cost per user and provider, what the agent did, and how it is running. Spend limits and a concurrency cap keep a budget a budget. Free to start. The free tier runs one provider for one user, for non-commercial use, with no license key. A license, priced per user, lifts both limits. Works on Splunk Enterprise 9.4, 10.0, 10.2, 10.4 and 10.6 and on Splunk Cloud, on a search head with KV Store, including search head clusters. The app sends no telemetry. Documentation: https://www.outcoldsolutions.com/docs/ai-agent/