Lynx AI Agent for Splunk

https://trylynx.ai/
Admin
Lynx AI Agent for Splunk supercharges your Splunk environment with AI-powered intelligence, helping...
Tokens:5,468
Snippets:74
Trust Score:3.3
Update:2 months ago
Show doc for...
Tokens:
Raw
### Access Setup Page URL

Source: https://docs.trylynx.ai/configuration

Direct URL path to access the setup dashboard when hidden from navigation.

```text
/app/lynx_ai_agent/setup_page_dashboard
```

--------------------------------

### Configure Initial Installation

Source: https://docs.trylynx.ai/configuration

Mark the application as configured in the local configuration file.

```ini
[install]
is_configured = 1
```

--------------------------------

### ai.conf Example Configuration

Source: https://docs.trylynx.ai/advanced/config-spec/ai.conf

A practical example of an ai.conf file, including system rules, risky command overrides, search settings, and on-premises AI model definitions.

```ini
[systemRules]
RULE-emdash = Avoid using em dashes (—) in responses
RULE-timepicker = Dashboards must always include a time picker

[riskyCommands]
allow_list = collect,outputlookup

[riskyCommand::foreach]
category = Performance Impact
description = Can cause significant performance degradation

[search]
earliest_time = -24h@h
latest_time = now
timeout = 120

# When in on-prem mode:

[aiModel::glm-4.7]
name = z-ai/glm-4.7
display_name = GLM 4.7
reasoning = false
context_window = 128000
inference_index = 1

[aiModel::glm-4.7-thinking]
name = z-ai/glm-4.7
display_name = GLM 4.7
reasoning = true
context_window = 200000
inference_index = 1
```

--------------------------------

### Validator Output Example

Source: https://docs.trylynx.ai/configuration

Sample output showing validation results for configuration files.

```text
$ ./bin/lynt.sh
=== Lynx AI Agent Validator ===

Validating default/ai.conf...
  ✓ No issues found

Validating local/ai.conf...
  ✗ Unknown parameter in [backend]: onprem_mod
  ✗ Unknown stanza: [riskyComands]
  ✗ Unknown parameter in [riskyComands]: allow_list

=== Summary ===
✗ Found 3 error(s)
```

--------------------------------

### Install Lynx AI Agent on Single Instance via CLI

Source: https://docs.trylynx.ai/installation

Extract the application package directly into the Splunk apps directory and restart the service.

```bash
tar -xvzf lynx_ai_agent.tgz -C $SPLUNK_HOME/etc/apps
```

```bash
$SPLUNK_HOME/bin/splunk restart
```

--------------------------------

### Reset Configuration Status

Source: https://docs.trylynx.ai/configuration

Set the configuration status to incomplete to re-trigger the setup page.

```ini
[install]
is_configured = 0
```

--------------------------------

### Configure Backend Environment Variables

Source: https://docs.trylynx.ai/advanced/on-premises

Define the required configuration settings in a .env file to enable on-premises mode and connect to your inference engine.

```text
# .env

# App
ONPREM_MODE=true 
TRUSTED_HOSTS=<host1>[,<host2>] 
LATEST_VERSION=<version> 
PORT=<port> 
SSL_ENABLED=<boolean> 
IPV6=<boolean> 

# Inference
INFERENCE_URL=<url> 
INFERENCE_API_KEY=<api_key>
INFERENCE_URL2=<url> 
INFERENCE_API_KEY2=<api_key>
GUARDRAIL=<boolean> 
COMPACT_MAX_TOKENS=<number> 
AUXILIARY_MODEL=<model> 
REPLAY_REASONING=<boolean> 
VERIFY_SSL=<boolean>
```

--------------------------------

### Configure Backend Server

Source: https://docs.trylynx.ai/configuration

Define the backend schema and server address for on-premises deployments.

```ini
[backend]
schema = https
server = example.com:3000
```

--------------------------------

### Run CopyCat CLI

Source: https://docs.trylynx.ai/copycat

Execute the standalone Python script to generate logs manually.

```bash
python copycat/bin/copycat.py [log_type] [options]
```

--------------------------------

### Deploy Backend Container

Source: https://docs.trylynx.ai/advanced/on-premises

Run the Lynx AI backend container using the specified environment file. Use the SSL-enabled command variant if your deployment requires custom certificate mounting.

```bash
docker run -d -p 3000:3000 --env-file .env \
  ghcr.io/trylynx-ai/ai-agent-for-splunk-backend:latest
```

```bash
docker run -d -p 3000:3000 --env-file .env \
  -v /path/to/fullchain.pem:/ssl/cert.pem:ro \
  -v /path/to/privkey.pem:/ssl/privkey.pem:ro \
  ghcr.io/trylynx-ai/ai-agent-for-splunk-backend:latest
```

--------------------------------

### Deploy Lynx AI Agent to Search Head Cluster

Source: https://docs.trylynx.ai/installation

Extract the application package to the cluster apps directory and apply the bundle via the deployer.

```bash
tar -xvzf lynx_ai_agent.tgz -C $SPLUNK_HOME/etc/shcluster/apps
```

```bash
$SPLUNK_HOME/bin/splunk apply shcluster-bundle -target https://<captain>:8089 -auth admin:<password>
```

--------------------------------

### Generate Application Logs

Source: https://docs.trylynx.ai/copycat

Generate a specified number of random application logs using the CLI.

```bash
$ uv run copycat/bin/copycat.py app --count 5
2026-01-19 10:23:45.123456 [INFO] /var/lib/app.log: System process completed.
2026-01-19 10:23:45.123456 [ERROR] /opt/config/service.py: Connection timeout invalid.
2026-01-19 10:23:45.123456 [WARN] /usr/bin/config.xml: Started found warning.
2026-01-19 10:23:45.123456 [DEBUG] /tmp/share/data.db: Process stopped successful.
2026-01-19 10:23:45.123456 [INFO] /home/log/system.conf: Updated completed.
```

--------------------------------

### Run Configuration Validator

Source: https://docs.trylynx.ai/configuration

Execute the validation script to check the integrity of configuration files.

```bash
cd $SPLUNK_HOME/etc/apps/lynx_ai_agent
./bin/lynt.sh
```

--------------------------------

### ai.conf Configuration Specification

Source: https://docs.trylynx.ai/advanced/config-spec/ai.conf

The full specification for the ai.conf file, detailing all available stanzas and parameters for configuring the Lynx AI Agent.

```ini
# This file contains settings and values that you can use to configure
# the Lynx AI Agent for Splunk.

[install]

is_configured = <boolean>
* Specifies whether the app is already configured on this search head.
* When set to false, opening the app will redirect the user to the configuration page.
* Default: false

[backend]

server = <string>
* The server hosting the backend API for the agent.
* Can include a port number if needed.
* Default: api.lynxai.dev

schema = <http|https>
* Schema to use for the backend API.
* HTTP is unencrypted and not recommended.
* Default: https

onprem_mode = <boolean>
* Set this to true if the specified backend server is hosted on-premises.
* If true, this requires that you also set at least one AI model stanza (see below).
* Default: false

[systemRules]

RULE-<name> = <string>
* A rule which is applied to all user conversations.
* From the point of view of the agent, the rule appears as the first message in the conversation.

[riskyCommands]

allow_list = <comma-separated list>
* Comma-separated list of risky commands the agent may be allowed to execute.
* Supported allow-list entries:
* map,collect,mcollect,meventcollect,outputcsv,outputlookup
* Explicitly disallowed:
* delete,dump,run,runshellscript,script,sendalert,sendemail,tscollect
* Everything in both lists is blocked unless added here
* Default: None

[riskyCommand::<command>]
* Use this stanza style to mark additional Splunk commands as risky.
* You will have to specify a category and a description for the UI to display.
* You can have multiple instances of this stanza.

category = <string>
* Category for the custom risky command.
* This will be used in the title of the risky command notification.

description = <string>
* Description for the custom risky command.
* Explain why this command should not be auto-executed by the agent.

[aiModel::<unique_name>]
* Only required if onprem_mode is set to true.
* Set this with an internal name for the model.

name = <string>
* This is the model name the backend will use to request data from the inference engine.
* Set this to the model name as it is served by vLLM or LiteLLM.

display_name = <string>
* Model name to display in the UI.
* This is the name that will be shown to the user.

reasoning = <boolean>
* Whether the model is expected to output reasoning tokens in the response.
* Note: The actual reasoning support is determined by the inference engine.

context_window = <integer>
* This value is used to show the current context fullness in the chat conversation.
* Not actually used by the backend, but displayed in the UI.

inference_index = <integer>
* Specifies which inference endpoint on the backend should be used with this model.
* Default: 1

[format]

auto_format_spl_query = <boolean>
* Toggles automatic formatting of SPL queries in chat responses.
* When enabled, the agent:
* 1. Inserts newlines after each pipe.
* 2. Normalizes spacing around pipes.
* 3. Removes trailing pipes.
* Default: true

[search]

earliest_time = <string>
* The default earliest time for search execution.
* Supported format: [+|-]<time_integer><time_unit>@<time_unit>
* Default: -15m@m

latest_time = <string>
* The default latest time for search execution.
* Supported format: [+|-]<time_integer><time_unit>@<time_unit>
* Default: now

timeout = <integer>
* The default timeout in seconds for search executions by the agent.
* Using a value of 0 will disable the timeout.
* Default: 60
```

--------------------------------

### Test Inference Endpoint Connection

Source: https://docs.trylynx.ai/advanced/on-premises

Use this curl command to verify that your inference endpoint is reachable and correctly configured to accept OpenAI-compatible requests.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     -H "Content-Type: application/json" \
     -d '{"model":"glm-5.1","messages":[{"role":"user","content":"What is the meaning of life?"}]}' \
     https://example.com/api/v1/chat/completions
```

--------------------------------

### Define System Rules in ai.conf

Source: https://docs.trylynx.ai/usage/rules

System rules are defined within the [systemRules] stanza of the ai.conf file using the RULE-<name> = <rule text> format.

```ini
[systemRules]
RULE-emdash = Avoid using em dashes (—) in responses
RULE-timepicker = Dashboards must always include a time picker
```

--------------------------------

### Configure passwords.conf for AI Agent

Source: https://docs.trylynx.ai/advanced/config-spec/passwords.conf

Defines the credential stanza for the AI Agent license key. Manual entry is discouraged as it bypasses Splunk's automatic encryption.

```ini
# This file maintains the credential information for a given app in Splunk Enterprise.

# In the context of the AI Agent for Splunk, we use this file to securely store the
# license key for the agent.

# Note that this is a Splunk-wide configuration file and should be handled with care.
# https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.0/configuration-file-reference/10.0.2-configuration-file-reference/passwords.conf

[credential:lynx_ai_agent_realm:license:]
* The credential used by the agent.

password = <string>
* The license key used by the agent.
* Saved automatically by the agent after completing the configuration process and encrypted by Splunk.
* While it can be manually set, it is not recommended, as it will not be encrypted by the Splunk instance.
```

--------------------------------

### Generate Historical Logs

Source: https://docs.trylynx.ai/copycat

Generate logs within a specific date range using the CLI.

```bash
$ uv run copycat/bin/copycat.py api --count 10 --start 2026-01-01T00:00:00 --end 2026-01-31T23:59:59
2026-01-05 14:32:18.456789 POST /api/orders from 10.20.30.40 - Response: 200 - 125ms
2026-01-08 09:15:42.123456 GET /api/users from 192.168.1.100 - Response: 200 - 89ms
...
```
Tokens:
Raw