The Dutch Data Difference
AI for Splunk that works inside your estate, and can prove what it did
We build governed AI for the teams that live in Splunk: security, operations, the platform team and the business. It answers questions, builds working Splunk content, investigates on its own when something happens and keeps systems in sync. It runs under your own Splunk roles, on the language model you choose, and your data never leaves your environment.
Built by a Splunk Enterprise Certified Architect with three decades in network and performance engineering.
Splunk holds the answers. Getting them out is the bottleneck.
Most Splunk estates are not short of data. They are short of people who can turn a question into working SPL, a dashboard, an alert or an investigation. That shows up in the same four places in almost every organisation.
The platform team is the queue
Every new question from security, operations or the business waits for the few people who write SPL well. The questions change every week. The backlog does not shrink.
Alerts without context
Analysts work the queue in order of arrival, because the alert does not say which service, owner or recent change it touches.
Red services, unclear causes
An ITSI service turns red and the first hour goes on finding out whether the system is broken or the feed behind it is.
Glue nobody owns
CMDB syncs, nightly checks and hand-offs between tools live in scripts and habits. They break quietly and someone finds out weeks later.
Everyone wants AI in Splunk. Most of it cannot be allowed near it.
For regulated organisations the question is not whether AI is useful. It is whether it can be trusted with the data, the permissions and the budget. These three objections stop most projects, and each has a concrete answer.
Data leakage
Most AI tools ship your indexed events to an external service. For a SOC that is a non-starter. Adjutant AI runs inside Splunk: bring your own model, keys stay on the server, or run fully offline on a local model.
Privilege escalation
An assistant that ignores Splunk roles is an incident waiting to happen. Every capability is derived from the user’s own Splunk roles, so the AI can never see or do more than the person asking.
Model lock-in
Picking one model today means re-platforming tomorrow. Use Anthropic, OpenAI, Azure OpenAI, Gemini, Groq, Bedrock, OpenRouter or a local Ollama model, and switch per team whenever you want.
Where the time comes back
These are the hours that disappear first. We do not quote savings percentages we cannot show you. The app records what every run cost and what it produced, in your own Splunk, so the saving is something you can check rather than something you are told.
Measured, not promised. Tokens and Costs reporting shows what each team spends on AI (Professional). The Outcome Ledger adds what that spend produced, per organisation and business unit (Enterprise).
Built on Splunk. Extra, not instead.
Splunk ships its own AI capabilities and an MCP Server, and they are worth using. Adjutant AI does not compete with them. It adds the depth, governance and automation that Splunk teams in regulated organisations ask for, and it can publish specific playbooks into Splunk’s own MCP Server, so your corporate AI chat gets defined scenarios instead of broad access.
- Inside your deployment. Runs on your search head, on the model you choose, including fully offline models. No data egress.
- Tools that understand each Splunk product. Core, Enterprise Security, ITSI, TrackMe, the AI Toolkit and ServiceNow, each tool scoped to one job and run under your existing permissions.
- Validated output. Searches and dashboards are run against real data before they are saved, into the app the user came from.
- Deterministic where it must be defensible. ITSI root cause and fraud data coverage are computed by code. The model explains the result; it does not decide it.
- Work that runs without you. Triggered by alerts, ES notables, ITSI episodes, schedules or other agents, as a governed service account.
- Accountable. Audit logging and agent telemetry as OCSF events, so your SOC can watch the AI like any other actor.
Your corporate AI chat can talk to Splunk. One scenario at a time.
Every organisation wants its own AI chat to answer questions about its Splunk data, and MCP makes the connection easy. The hard part is what you connect. Hand the chat broad Splunk tools and it can search anything, in any way, with answers that differ each time. That is difficult to govern and hard to trust.
Connecting the platform
The chat gets general tools: run a search, list indexes, read results. It decides how to answer a question, every time again. What it may touch is only as narrow as the account behind it, and every answer is a new improvisation.
Connecting a playbook
You tag the playbooks the chat may use, such as a host health check or an incident summary. The chat can only list and run those. Each one is a reviewed, repeatable scenario that runs inside Splunk, scoped to an organisation and business unit, with a history entry for every run.
How it connects. Tagged playbooks are published through Splunk’s own MCP Server, next to Splunk’s own tools, or through Adjutant’s standalone MCP endpoint, which offers nothing but your playbooks. Access uses Splunk tokens. From Adjutant, the chat only ever sees what you tagged. See the use case
Four ways to put it to work
The same engine answers when someone asks, reacts when something happens, runs on a clock and responds when another system calls it.
Interactive Ask
Ask in plain language inside Search, ITSI, ES or your own app. Get validated SPL, dashboards, alerts and ML pipelines back.
Event-driven and Scheduled Ask
Investigations that start from an alert, a notable or an ITSI episode, or on a schedule, and report back where your team works.
MCP Ask
Your corporate AI chat runs the specific Splunk playbooks you choose, through Splunk’s own MCP Server. Scenarios, not the keys to the platform.
AI-driven integration
Move records between systems on a mapping a human reviewed, with watermarks, drift checks and proof of what landed.
From a question to a saved Splunk object
What happens when someone asks, in four steps.
Open in context
The analyst opens Adjutant AI from a menu entry inside Search, ITSI, ES or a custom app.
Scope to the user
Available playbooks, tools and models follow from that app and the user’s Splunk roles.
Generate and validate
The chosen model drafts SPL or markup, runs it against real data and corrects itself when it fails.
Land in the right app
The dashboard, alert or saved search is written into that app, owned by the user, ready to use.
Two products
One is available today. The other is released early as a preview, so the people who will use it can shape it.
Adjutant AI
Formerly AI Workbench
A workbench for Splunk teams, not a chatbot. Analyse, correlate and build across SPL, dashboards, alerts, the AI Toolkit, ES, ITSI and TrackMe, and let the same playbooks run unattended.
Adjutant AI Domain Workspace
For business users
Ask a business question in plain language and get a verified panel back, under your own roles, with every claim labelled. The preview runs on fictitious data; the working version follows.
Rather have an architect than an app? The person who built Adjutant AI also takes on a small number of Splunk and AI consulting engagements: automating one type of investigation, finding the root cause of a problem that keeps coming back, connecting Splunk to the tools around it, or getting more out of the licence you already have. Splunk and AI consulting
Start free inside your own Splunk. Pay when it earns its place.
Start with the free Personal edition as one user. Move to Professional when your team needs it. For security, integration and governance at scale, a 30-day Proof of Value with success criteria agreed up front is the fastest way to decide.