See how customers are using the AI Toolkit!
Splunk AI Toolkit
Build, test, deploy, and review agentic AI, foundation models, and predictive ML directly in Splunk Platform, governed by your existing controls.
Run custom AI on the data that runs your business. No data movement, no separate stack.
Build agents on Splunk
Easily build and deploy governed, auditable agents. Splunk data and tools are accessible to agents through integration with knowledge bases, Splunk MCP server, and external MCP integrations.
Run GenAI inside Splunk Cloud
Run Splunk hosted models like Foundation AI Security, Cisco Deep Time Series, and GPT-OSS natively in Splunk Cloud — no GPUs, no API keys, no data egress. Use third-party frontier models or self-host via Ollama.
Run ML on your data
Accelerate development with hundreds of built-in ML templates or your custom models via ONNX and AWS SageMaker. Guided assistants simplify forecasting, outlier detection, clustering, and prediction for all users. Smart Assistants guide non-data-scientists through forecasting, outlier detection, clustering, and prediction.
Features
Everything you need to build custom AI on Splunk
Save time using pre-built components.
Agent Launchpad
Use Agent Launchpad to create, test, and deploy RBAC-governed, auditable agents that use Splunk data and tools. Agents reason with hosted models, ground decision in RAG and knowledge bases, and act through Splunk and external MCP integrations.
Hosted Foundation Models
Generative AI models are hosted natively inside the Splunk Platform boundary. Use Foundation-Sec for security, Cisco Deep Time Series Model for forecasting and anomaly detection, GPT-OSS for general reasoning. No GPUs, no API keys, no data movement required.
External LLM Model Integration
Integrate any model, from frontier LLMs to custom ONNX and Amazon SageMaker builds, directly with Splunk Platform data. Use the AI Toolkit and DSDL as your inference and orchestration surface to keep existing model investments portable and scalable.
Custom ML Models
Build custom ML models using hundreds of built-in algorithms with guided and code-first workflows and multivariate support. Smart Assistants guide you through forecasting, outliers, clustering, and prediction.
Run ML and GenAI from SPL
Your models become first-class search commands across Splunk Cloud and Enterprise, and your existing dashboards, alerts, and reports continue to work unchanged.
Spot the red flags with anomaly detection
Through intensive training, AI and machine learning establish baselines for your data and detect deviations from past behavior or atypicalities that might otherwise go undetected. See how the National Ignition Facility identifies atypical behavior as it monitors the U.S. nuclear stockpile.
See the unseen in your data with clustering
There are patterns in your data that human analysts will miss: trends in ITOps and in security, and patterns in customer behaviors that suggest new markets and opportunities. Automate analysis of clusters to identify and group similar data points to help you see the signals in the noise, and make better decisions. See how pharma startup Recursion identifies high-value patterns in large sets of genetic research data.
AI Toolkit FAQ's
The Splunk AI Toolkit is for everyone — from novice analysts to expert ML engineers. It provides a scalable environment to build, test, and operationalize AI:
- For security and observability, analysts: Use no-code features like Agent Launchpad to automate repetitive workflows and build AI agents without prior ML expertise.
- For ITOps and SREs: Use Smart Assistants to easily detect outliers, forecast system capacity, and cluster events to reduce noise.
- For data scientists and ML engineers: Use ML-SPL commands and DSDL containers to build and deploy custom models, or integrate frontier LLMs directly into your search pipelines.
Whether you are using guided assistants or orchestrating complex GenAI workflows, your models remain portable and integrated into your existing Splunk dashboards and alerts.
Splunk Machine Learning Toolkit was renamed to the Splunk AI Toolkit in version 5.6.3, and now AI Toolkit has more capabilities. All capabilities from MLTK, including Smart Assistants, ML-SPL commands, and the algorithm library, remain in AI Toolkit. New capabilities include hosted foundation models, RAG, knowledge bases, and MCP server support.
AI Toolkit runs on both Splunk Cloud Platform and Splunk Enterprise. Splunk-hosted foundation models are available on Splunk Cloud Platform only.
Download AI Toolkit from Splunkbase.
AI Toolkit is the build layer for custom AI. Use it to train ML models, run hosted foundation models, set up RAG and MCP infrastructure. AI Assistant for SPL helps users write SPL queries. Agent Launchpad uses AI Toolkit infrastructure to create governed, auditable agents.
You don’t need to be an expert in data science. Smart Assistants are designed for SPL users without a data science background.
Experiment Assistants and direct ML-SPL commands are for data scientists and ML engineers building custom models.
