Adjutant AI, formerly AI Workbench
A workbench for Splunk, not a chatbot
Investigate, analyse and build with tools that understand Splunk. Ask in plain language and get validated searches, dashboards, alerts and machine learning pipelines back, grounded in your own knowledge objects and saved into the app you are working in. When you are ready, the same playbooks run without you.
Splunkbase app 8747. Splunk Enterprise and Splunk Cloud, 9.4 through 10.4.
One install. It takes the shape of every app it serves.
Adjutant AI is a host shell with no use cases of its own. It derives everything from the Splunk app a user opens it from and the roles that user holds. Install it once on the search head and add it to the menus of the apps your teams already live in.
- Artefacts land where the user is. Saved searches, dashboards and alerts are written into the calling app, owned by the calling user.
- Tenancy is automatic. Organisation and business unit follow from the app and the user’s roles; nobody picks a tenant.
- Access follows Splunk. Playbooks, tools and models scoped to one team are invisible to another.
- Your model, server-side. Keys stay on the search head. Switch providers per tenant, or run fully offline.
What you get
Grouped by what it does for you. The pricing page lists exactly which edition includes what.
Validated generation
SPL, Simple XML and Dashboard Studio dashboards, alerts, lookups, reports and AI Toolkit pipelines, run against real data before they are saved.
Tools that know each product
Fine-grained tools for Core, Enterprise Security, ITSI, TrackMe, ServiceNow and the AI Toolkit, each scoped to one job and run under your ACLs.
ITSI root cause analysis
Walks your real dependency graph, verifies the data behind every KPI and scores the evidence transparently. The same evidence always gives the same answer.
Fraud readiness and ring detection
Grades nine fraud typologies against your data, then finds rings in the risk index that per-account thresholds miss. Nothing generated is enabled for you.
Unattended automation
Playbooks triggered by alerts, ES notables, ITSI episodes and schedules, with chains, dependencies and a history entry for every run.
AI-driven integration
Versioned mappings with four-eyes promotion, watermarks and drift checks. The runner moves the data; the model never transforms rows.
MCP in both directions
Publish the specific playbooks you tag to your corporate AI chat through Splunk’s own MCP Server, instead of exposing Splunk as a whole. And use any MCP server as a tool inside Adjutant.
Governance your SOC can watch
Audit logging, a governance change log, and agent telemetry as OCSF events into an index ES already watches. Off by default.
Multi-tenant, multi-org
Organisations and business units, per-tenant tools and models, per-tenant cost reporting, and one key across multiple environments for MSPs.
Editions
Higher editions include everything below them.
Personal
Free. One user. Validated generation, your own model, knowledge and data-quality checks.
Professional
$600 per month. Unlimited users, up to three business units, history, costs, onboarding and unattended runs.
Enterprise
Tailored. Security and ITSI workflows, MCP, audit and governance, reliability and agent telemetry.
MSP
Tailored. Unlimited organisations, multiple environments on one key, per-environment isolation.
Requirements
Everything runs on your own infrastructure. No component of Adjutant AI runs as a service outside your Splunk.
- Splunk. Splunk Enterprise or Splunk Cloud, versions 9.4 through 10.4. Installed on the search head.
- Language model. Anthropic, OpenAI, Azure OpenAI, Gemini, Groq, Amazon Bedrock, OpenRouter, or a local Ollama model for fully offline use.
- Optional integrations. Enterprise Security, ITSI, TrackMe, the AI Toolkit, ServiceNow, Cribl Stream, Splunk Edge Processor and any MCP server.
- Evaluation. Install the free Personal edition, or run a 30-day Proof of Value with success criteria agreed up front.
Try it in your own Splunk
The Personal edition is free and needs no licence key. For a team evaluation, we agree the success criteria first and measure against them in your environment.