### Access Setup Page URL Source: https://docs.trylynx.ai/configuration Direct URL path to access the setup dashboard when hidden from navigation. ```text /app/lynx_ai_agent/setup_page_dashboard ``` -------------------------------- ### Configure Initial Installation Source: https://docs.trylynx.ai/configuration Mark the application as configured in the local configuration file. ```ini [install] is_configured = 1 ``` -------------------------------- ### ai.conf Example Configuration Source: https://docs.trylynx.ai/advanced/config-spec/ai.conf A practical example of an ai.conf file, including system rules, risky command overrides, search settings, and on-premises AI model definitions. ```ini [systemRules] RULE-emdash = Avoid using em dashes (—) in responses RULE-timepicker = Dashboards must always include a time picker [riskyCommands] allow_list = collect,outputlookup [riskyCommand::foreach] category = Performance Impact description = Can cause significant performance degradation [search] earliest_time = -24h@h latest_time = now timeout = 120 # When in on-prem mode: [aiModel::glm-4.7] name = z-ai/glm-4.7 display_name = GLM 4.7 reasoning = false context_window = 128000 inference_index = 1 [aiModel::glm-4.7-thinking] name = z-ai/glm-4.7 display_name = GLM 4.7 reasoning = true context_window = 200000 inference_index = 1 ``` -------------------------------- ### Validator Output Example Source: https://docs.trylynx.ai/configuration Sample output showing validation results for configuration files. ```text $ ./bin/lynt.sh === Lynx AI Agent Validator === Validating default/ai.conf... ✓ No issues found Validating local/ai.conf... ✗ Unknown parameter in [backend]: onprem_mod ✗ Unknown stanza: [riskyComands] ✗ Unknown parameter in [riskyComands]: allow_list === Summary === ✗ Found 3 error(s) ``` -------------------------------- ### Install Lynx AI Agent on Single Instance via CLI Source: https://docs.trylynx.ai/installation Extract the application package directly into the Splunk apps directory and restart the service. ```bash tar -xvzf lynx_ai_agent.tgz -C $SPLUNK_HOME/etc/apps ``` ```bash $SPLUNK_HOME/bin/splunk restart ``` -------------------------------- ### Reset Configuration Status Source: https://docs.trylynx.ai/configuration Set the configuration status to incomplete to re-trigger the setup page. ```ini [install] is_configured = 0 ``` -------------------------------- ### Configure Backend Environment Variables Source: https://docs.trylynx.ai/advanced/on-premises Define the required configuration settings in a .env file to enable on-premises mode and connect to your inference engine. ```text # .env # App ONPREM_MODE=true TRUSTED_HOSTS=[,] LATEST_VERSION= PORT= SSL_ENABLED= IPV6= # Inference INFERENCE_URL= INFERENCE_API_KEY= INFERENCE_URL2= INFERENCE_API_KEY2= GUARDRAIL= COMPACT_MAX_TOKENS= AUXILIARY_MODEL= REPLAY_REASONING= VERIFY_SSL= ``` -------------------------------- ### Configure Backend Server Source: https://docs.trylynx.ai/configuration Define the backend schema and server address for on-premises deployments. ```ini [backend] schema = https server = example.com:3000 ``` -------------------------------- ### Run CopyCat CLI Source: https://docs.trylynx.ai/copycat Execute the standalone Python script to generate logs manually. ```bash python copycat/bin/copycat.py [log_type] [options] ``` -------------------------------- ### Deploy Backend Container Source: https://docs.trylynx.ai/advanced/on-premises Run the Lynx AI backend container using the specified environment file. Use the SSL-enabled command variant if your deployment requires custom certificate mounting. ```bash docker run -d -p 3000:3000 --env-file .env \ ghcr.io/trylynx-ai/ai-agent-for-splunk-backend:latest ``` ```bash docker run -d -p 3000:3000 --env-file .env \ -v /path/to/fullchain.pem:/ssl/cert.pem:ro \ -v /path/to/privkey.pem:/ssl/privkey.pem:ro \ ghcr.io/trylynx-ai/ai-agent-for-splunk-backend:latest ``` -------------------------------- ### Deploy Lynx AI Agent to Search Head Cluster Source: https://docs.trylynx.ai/installation Extract the application package to the cluster apps directory and apply the bundle via the deployer. ```bash tar -xvzf lynx_ai_agent.tgz -C $SPLUNK_HOME/etc/shcluster/apps ``` ```bash $SPLUNK_HOME/bin/splunk apply shcluster-bundle -target https://:8089 -auth admin: ``` -------------------------------- ### Generate Application Logs Source: https://docs.trylynx.ai/copycat Generate a specified number of random application logs using the CLI. ```bash $ uv run copycat/bin/copycat.py app --count 5 2026-01-19 10:23:45.123456 [INFO] /var/lib/app.log: System process completed. 2026-01-19 10:23:45.123456 [ERROR] /opt/config/service.py: Connection timeout invalid. 2026-01-19 10:23:45.123456 [WARN] /usr/bin/config.xml: Started found warning. 2026-01-19 10:23:45.123456 [DEBUG] /tmp/share/data.db: Process stopped successful. 2026-01-19 10:23:45.123456 [INFO] /home/log/system.conf: Updated completed. ``` -------------------------------- ### Run Configuration Validator Source: https://docs.trylynx.ai/configuration Execute the validation script to check the integrity of configuration files. ```bash cd $SPLUNK_HOME/etc/apps/lynx_ai_agent ./bin/lynt.sh ``` -------------------------------- ### ai.conf Configuration Specification Source: https://docs.trylynx.ai/advanced/config-spec/ai.conf The full specification for the ai.conf file, detailing all available stanzas and parameters for configuring the Lynx AI Agent. ```ini # This file contains settings and values that you can use to configure # the Lynx AI Agent for Splunk. [install] is_configured = * Specifies whether the app is already configured on this search head. * When set to false, opening the app will redirect the user to the configuration page. * Default: false [backend] server = * The server hosting the backend API for the agent. * Can include a port number if needed. * Default: api.lynxai.dev schema = * Schema to use for the backend API. * HTTP is unencrypted and not recommended. * Default: https onprem_mode = * Set this to true if the specified backend server is hosted on-premises. * If true, this requires that you also set at least one AI model stanza (see below). * Default: false [systemRules] RULE- = * A rule which is applied to all user conversations. * From the point of view of the agent, the rule appears as the first message in the conversation. [riskyCommands] allow_list = * Comma-separated list of risky commands the agent may be allowed to execute. * Supported allow-list entries: * map,collect,mcollect,meventcollect,outputcsv,outputlookup * Explicitly disallowed: * delete,dump,run,runshellscript,script,sendalert,sendemail,tscollect * Everything in both lists is blocked unless added here * Default: None [riskyCommand::] * Use this stanza style to mark additional Splunk commands as risky. * You will have to specify a category and a description for the UI to display. * You can have multiple instances of this stanza. category = * Category for the custom risky command. * This will be used in the title of the risky command notification. description = * Description for the custom risky command. * Explain why this command should not be auto-executed by the agent. [aiModel::] * Only required if onprem_mode is set to true. * Set this with an internal name for the model. name = * This is the model name the backend will use to request data from the inference engine. * Set this to the model name as it is served by vLLM or LiteLLM. display_name = * Model name to display in the UI. * This is the name that will be shown to the user. reasoning = * Whether the model is expected to output reasoning tokens in the response. * Note: The actual reasoning support is determined by the inference engine. context_window = * This value is used to show the current context fullness in the chat conversation. * Not actually used by the backend, but displayed in the UI. inference_index = * Specifies which inference endpoint on the backend should be used with this model. * Default: 1 [format] auto_format_spl_query = * Toggles automatic formatting of SPL queries in chat responses. * When enabled, the agent: * 1. Inserts newlines after each pipe. * 2. Normalizes spacing around pipes. * 3. Removes trailing pipes. * Default: true [search] earliest_time = * The default earliest time for search execution. * Supported format: [+|-]@ * Default: -15m@m latest_time = * The default latest time for search execution. * Supported format: [+|-]@ * Default: now timeout = * The default timeout in seconds for search executions by the agent. * Using a value of 0 will disable the timeout. * Default: 60 ``` -------------------------------- ### Test Inference Endpoint Connection Source: https://docs.trylynx.ai/advanced/on-premises Use this curl command to verify that your inference endpoint is reachable and correctly configured to accept OpenAI-compatible requests. ```bash curl -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"model":"glm-5.1","messages":[{"role":"user","content":"What is the meaning of life?"}]}' \ https://example.com/api/v1/chat/completions ``` -------------------------------- ### Define System Rules in ai.conf Source: https://docs.trylynx.ai/usage/rules System rules are defined within the [systemRules] stanza of the ai.conf file using the RULE- = format. ```ini [systemRules] RULE-emdash = Avoid using em dashes (—) in responses RULE-timepicker = Dashboards must always include a time picker ``` -------------------------------- ### Configure passwords.conf for AI Agent Source: https://docs.trylynx.ai/advanced/config-spec/passwords.conf Defines the credential stanza for the AI Agent license key. Manual entry is discouraged as it bypasses Splunk's automatic encryption. ```ini # This file maintains the credential information for a given app in Splunk Enterprise. # In the context of the AI Agent for Splunk, we use this file to securely store the # license key for the agent. # Note that this is a Splunk-wide configuration file and should be handled with care. # https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.0/configuration-file-reference/10.0.2-configuration-file-reference/passwords.conf [credential:lynx_ai_agent_realm:license:] * The credential used by the agent. password = * The license key used by the agent. * Saved automatically by the agent after completing the configuration process and encrypted by Splunk. * While it can be manually set, it is not recommended, as it will not be encrypted by the Splunk instance. ``` -------------------------------- ### Generate Historical Logs Source: https://docs.trylynx.ai/copycat Generate logs within a specific date range using the CLI. ```bash $ uv run copycat/bin/copycat.py api --count 10 --start 2026-01-01T00:00:00 --end 2026-01-31T23:59:59 2026-01-05 14:32:18.456789 POST /api/orders from 10.20.30.40 - Response: 200 - 125ms 2026-01-08 09:15:42.123456 GET /api/users from 192.168.1.100 - Response: 200 - 89ms ... ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.