Inno AI Chat

Ask your data a question.
Get an answer you can check.

Inno AI Chat answers questions about your Splunk data in plain language — and shows you the SPL it used, so you can read it, re-run it, and disagree with it. It runs against a language model on hardware you control, which means it works in the environments that cannot send operational data to a hosted model.

Model on your own hardware · answers grounded in your environment · the SPL comes with the answer · nothing leaves your network

Pricing & how to buy

What it does

Plain language in, SPL out

Ask "which hosts got slower this week" and get an answer plus the search that produced it. You can paste the SPL into Splunk, change the window, and make it your own saved search. Result tables and charts are built from the rows the search actually returned.

Grounded in your environment

Indexes, sourcetypes, field names and values differ in every deployment, and a model that guesses them confidently is worse than one that says nothing. The app measures what exists in your Splunk — daily, with fieldsummary and tstats — and the assistant works from that instead of from what a model assumes Splunk data looks like.

Answers you can audit

Every answer carries the query behind it. If it is wrong, you can see why it is wrong — which is the difference between a tool an operations team will adopt and one they quietly stop opening.

Inside Splunk, not beside it

A Splunk app, in your Splunk, using your roles and permissions. Administrators get a tuning workspace — system prompt, guard settings, SPL generation settings and catalog concepts, with version history.

Curated knowledge is available for three domains: network, security and IT operations.

Why on-premises

The environments that most need this are the ones that cannot use hosted models.

Regulated industries, defence, air-gapped sites, and anyone whose logs contain customer data have largely been unable to adopt AI assistants for operations — not because the models are not good enough, but because the data cannot leave. Inno AI Chat is built for that constraint: the model runs on hardware you control, and no telemetry, query or answer is transmitted to us.

How it works

Requirements

Generated SPL and interpretations can be wrong or incomplete. How accurate the answers are depends on your data, your schema and the model you run. Inno AI Chat shows its work so you can check it, and it is meant to support operational and security decisions — not to replace them.

Licensing

One search head cluster, one domain

A licence covers one Splunk search head cluster and one domain (network, security or IT operations). A standalone search head counts as one cluster. Development and production are separate clusters.

Perpetual

Buy once and keep using it. Updates within the major version you bought are included. A later major version is a separate purchase; the version you have keeps working.

Locked to your deployment

A key is issued against your Splunk deployment ID — your cluster's own identifier — and only answers for the domains written in it. One key covers every member of the cluster.

Offline — no phone-home

Keys are signed and verified locally. Nothing contacts a licence server, so air-gapped and network-restricted deployments work exactly like connected ones.

We need your deployment ID to issue a key. Run this in Splunk Search as an administrator, on the search head (any member of a search head cluster): 
| rest splunk_server=local /services/server/info
| fields guid
| appendcols [| rest splunk_server=local /services/configs/conf-server/shclustering | fields disabled]
| appendcols [| rest splunk_server=local /services/shcluster/status | fields captain.id | rename captain.id as shc_id]
| eval shc_on=if(match(lower(coalesce(disabled,"1")), "^(0|false|f|no|n)$"), 1, 0)
| eval deployment_id=case(shc_on==0, upper(guid), isnotnull(shc_id) AND shc_id!="", upper(shc_id), true(), "RETRY - cluster status not ready")
| eval kind=if(shc_on==1, "shc", "sh")
| table deployment_id kind

A search head cluster reports kind = shc and the same value on every member; a standalone search head reports kind = sh (it may also show a notice that search head clustering is not enabled — that is expected). If a cluster member reports RETRY, the cluster is electing a captain; run it again in a minute. Not sure? Ask us before you buy — a key issued for the wrong deployment will not unlock anything.

Pricing

USD 2,000 per search head cluster, per domain — one-time.

No per-user, per-host, per-GB or per-question fees. Running network on a development cluster and a production cluster is two licences; adding security to the same cluster is one more.

Inno AI Chat

$2,000 one-time

per search head cluster, per domain

  • Perpetual licence
  • Updates within the purchased major version
  • Up to 20 accuracy-tuning rounds within 3 months of purchase
  • Tuning for any model up to 75B total parameters — no extra fee
  • Email support
Buy now
After payment you receive one email from [email protected] with your licence key and download links for the installation files. The links work for 30 days and only for your purchase — reply to the email if you need new ones. Check your spam folder if it has not arrived within a few minutes.

Payments are processed by Paddle.com, our merchant of record. Applicable taxes are handled at checkout. Purchases are not refundable — see the refund policy and talk to us before you buy if you are unsure it fits your environment. Need an invoice or a purchase order instead? Email [email protected].

How tuning works

Tuning improves answer accuracy for your environment by adjusting prompts, the knowledge catalog, guard rules and SPL-generation settings — it does not retrain the model. For each round you provide 30 questions your team actually asks, sample data, the logs we ask for, and the output of the patch we send you. We never connect to your systems. Models above 75B total parameters are not covered. Improvement is not guaranteed — we commit to a reasonable effort.

FAQ

Is there a free tier or a trial?

No. Without a valid licence key the app installs but the chat does not answer. If you are unsure whether it fits your environment, talk to us first.

How do I get the app?

By email, right after payment: your licence key and download links for the backend bundle and its Python runtime. The links are for your purchase only and work for 30 days. The Splunkbase listing points here; the package is not downloadable from Splunkbase.

Which model does it use?

The one you run — any OpenAI-compatible endpoint on your hardware. We have measured it most on the Qwen3.x and Gemma4 families.

Does anything leave our network?

No. Questions go to the model you operate, searches run on your Splunk, and the app writes its own operational records to an index in your Splunk. Nothing is sent to us. When you ask for tuning, you choose what to send us.

What if our deployment ID changes?

Rebuilding a search head cluster, reinstalling Splunk or turning a standalone search head into a cluster changes it. Email us and we reissue the key for the same licence.

Can we add a domain later?

Yes — buy the domain for that cluster and we send a new key that covers both domains. Each purchase comes with its own 3-month tuning window.

Terms: End User License Agreement and Support & Tuning Terms · Refund policy · Privacy