Datch vs. Splunk AI Assistant for SPL

Splunk AI Assistant for SPL is well suited for people wanting to code on splunk but have limited or few knowledge on SPL requests. It can be good for people learning and training but also for business applying their own business case thanks to the AI, good for simple case scenario. However, for more complex scenario, involving for example multiple dashboard linked with workflow (get/post) and treillis, leading to other dashboard etc.. AI can be limited to the memory it can hold in.

Incentivized

• Create complex requests
• Optimize SPL requests
• learning and training

Incentivized

• more data awareness of the issue
• explain more about best practice and performance issue in some query
• can't be used for complex panel, where it requires to check multiple panels, with multiple sources and sourcetype and complex dashboarding linked

Incentivized

Splunk AI Assistant for SPL is good tool, as I said, it is really useful for educational purpose, taking in its hands small and simple tasks (ex:small query dashboard,...), but it's not a ten because the contextual memory for complex issues/dashboarding/reports etc can be limited, and can sometime suggets none optimized query which are not always checked by teammates and can cause issue on the long term.

Incentivized

CoPilot AI and ChatGPT I think lacks context so compared to Splunk AI Assistant for SPL they almost always answer something that do not work. Gemini is better than those two but Splunk AI Assistant for SPL still have the most knowledge for SPL and suggets SPL query that always works but performance can be limited on some of these.

Incentivized

• Quicker training (so people are delivering way sooner) --> 2 weeks of training, now only 1 necessary
• Small and reduntant tasks done by AI, taking way much time, sometimes dividing by 2 the time
• People check less their query, which can lead to multiple rechecks and lost time

Incentivized