Splunk AI Footnotes
What Splunk's AI features do with your data, as Splunk publishes it. Checked October 31, 2026. Splunk in the Directory.
Agent access
Splunk MCP Server, a Splunk-supported app from Splunkbase installed on the search head (version 2.1.0 released October 23, 2026). Admins manage which tools MCP clients can use, set rate limits and allowed SPL commands, and can map roles to tools. Splunk Observability Cloud data is reached through the hosted Splunk MCP Gateway. source, source 2, source 3, source 4, source 5, source 6, source 7, source 8, source 9, source 10 · checked October 31, 2026
Splunk AI Assistant (formerly Splunk AI Assistant for SPL)
Splunk Cloud Platform; Splunk Enterprise through Cloud Connected
| On by default? | Not published as of October 31, 2026 |
|---|---|
| How an admin turns it off | An administrator uses the assistant's Settings page, General tab, for the training opt-in, context data and Agent Mode. Only users with write permission for the app can change the training setting. source, source 2 · checked October 31, 2026 |
| Trains on customer data? | No, unless an administrator opts in through the assistant's settings (Splunk Specific Terms, AI Offerings section). Splunk may use feedback for training regardless. Splunk uses inputs, outputs and feedback to provide and maintain the service. source, source 2, source 3, source 4, source 5 · checked October 31, 2026 |
| Retention | Chat data is stored in the KV Store on the customer's stack and deleted when the user deletes the chat. Other AI service data is deleted through a support ticket, or generally when the Splunk Cloud Platform subscription is de-provisioned. With the training opt-in, some data may not be deletable. source, source 2 · checked October 31, 2026 |
| Where data is processed | Runs as a separate service in each supported AWS or Azure region. With the Splunk-hosted model, prompts go to an LLM in the same region as the tenant. source, source 2 · checked October 31, 2026 |
| Model providers | Splunk-hosted LLMs: the settings offer Gemma 4 or GPT OSS 120B. source · checked October 31, 2026 |
| Price | Included at no additional fee for active Splunk Cloud Platform and Splunk Enterprise customers. The assistant is not metered like searches; searches a user then runs from its output consume resources like any other search. source, source 2, source 3 · checked October 31, 2026 |
AI Assistant in Security and agentic SOC agents
Splunk Enterprise Security 8 (Essentials and Premier), on Splunk Cloud Platform or Cloud Connected deployments
| On by default? | Not published as of October 31, 2026 |
|---|---|
| How an admin turns it off | Enterprise Security: Configure > All configurations > AI > Global AI settings. The AI availability toggle turns all AI capabilities on or off; the same page holds the training opt-in and the model choice. source, source 2, source 3 · checked October 31, 2026 |
| Trains on customer data? | No, unless an administrator opts in (Splunk Specific Terms, AI Offerings section). Opting out later stops use of new data but does not delete data already collected. Splunk may use feedback for training regardless. Separately, the terms let Splunk use Threat Data from the Enterprise Security hosted service to train algorithms, detections and models. source, source 2, source 3, source 4, source 5 · checked October 31, 2026 |
| Retention | Not published as of October 31, 2026 |
| Where data is processed | Runs on Splunk's AI Platform Service, hosted in Splunk Cloud Platform. Admins can limit requests to Splunk-hosted models so telemetry and logs stay within Splunk's environment; the default option also uses frontier models hosted by a cloud provider. This choice does not apply to Splunk SOAR or Splunk Attack Analyzer. source, source 2, source 3 · checked October 31, 2026 |
| Model providers | Frontier or Splunk-hosted models, chosen under Global AI settings > Model choice. Splunk names Microsoft's Azure OpenAI terms for these features. source, source 2, source 3 · checked October 31, 2026 |
| Price | Varies by edition: each agent is listed for Enterprise Security Essentials and Premier or Premier only. The AI SOC analyst agent (Triage and Response agents) is in Premier. No list price is published. source · checked October 31, 2026 |
AI Assistant in Observability Cloud
Splunk Observability Cloud
| On by default? | On by default. source · checked October 31, 2026 |
|---|---|
| How an admin turns it off | Settings > General Organization Settings > AI Assistant Management, where an admin sets whether AI service data may be used for research and development (off by default). The page does not describe a switch that turns the assistant off. source, source 2 · checked October 31, 2026 |
| Trains on customer data? | No, unless an administrator opts in (Splunk Specific Terms, AI Offerings section). Sharing data for research and development is off by default in AI Assistant Management. Splunk may use feedback for training regardless. source, source 2, source 3 · checked October 31, 2026 |
| Retention | Not published as of October 31, 2026 |
| Where data is processed | Available in all AWS realms except GovCloud, and in GCP realms. Data needed to answer a prompt (the prompt, tool descriptions and tool results) goes to third-party LLM services; other data stays within the Splunk compliance boundary. source, source 2 · checked October 31, 2026 |
| Model providers | LLMs provided by a cloud vendor that Splunk does not name on this page; the help page says the assistant is subject to Microsoft's Azure OpenAI Acceptable Use Policy. source, source 2 · checked October 31, 2026 |
| Price | Not published as of October 31, 2026 |
Compliance
- FedRAMP: Splunk Cloud Platform FedRAMP Moderate and FedRAMP High are authorized by the GSA FedRAMP PMO. Splunk AI Assistant has limited support on IL 2 FedRAMP deployments. The AI Assistant in Observability Cloud is not available in GovCloud realms. source, source 2, source 3, source 4 · checked October 31, 2026
EU AI Act
Splunk publishes no EU AI Act statement of its own. Its parent company Cisco says it signed the EU AI Pact (September 2024), and the European Commission's list of AI Pact pledge signatories includes Cisco. source, source 2 · checked October 31, 2026
Not published by Splunk as of October 31, 2026
- Whether Splunk AI Assistant is on or off when a stack receives it through Splunk's rollout
- Whether the AI Assistant in Enterprise Security is on or off by default
- Retention period for prompts and responses in the AI Assistant in Enterprise Security and in Observability Cloud
- List price for Enterprise Security Essentials and Premier
- A current AI sub-processor list on a public page (Splunk's list is retired; it points to per-offering Offer Disclosures in Cisco's Trust Portal)
- Whether Splunk's AI assistants connect to outside MCP servers the customer chooses
- Whether Splunk AI Assistant sends prompts to third-party models. Splunk's pages differ: the 2.3.6 help pages say Model Runtime, which uses models hosted in Azure OpenAI, is on by default from version 1.4.0; the Responsible AI page for the assistant says data is not sent to or used with any third-party genAI service
- A release stage for the Splunk MCP Server. Splunk's pages differ: the MCP Server 1.3 documentation says it is generally available as of version 1.0.0; the Splunkbase listing for the current version, 2.1.0, says it is in beta
Changes
No changes recorded since the first check on October 31, 2026.
How this page is made, and how to send a correction: method.