Skip to content

v2.0.10

Choose a tag to compare

View all tags
@sooua sooua released this 06 Oct 04:19
· 5 commits to main since this release
v2.0.10
52d57d5
  • License page: the .lic file from the license server can now be uploaded or pasted
    as-is. Uploaded files show as a card with the license ID and expiry, the token is not
    shown on screen, and a .lic for another product or in the wrong format gets a
    specific error instead of a generic signature failure.
  • Enterprise Security: the alert list now shows each notable's current ES status
    (including custom statuses) and its current Incident Review urgency, and the detail
    drawer shows status, owner and disposition. Batch triage ranks ES notables by their
    current urgency.
  • Enterprise Security write-back offers the statuses actually configured in ES,
    including custom ones such as "Awaiting Customer", and falls back to the five ES
    defaults when the list cannot be read.
  • AI settings: the embeddings max input length ([embeddings] max_input_chars) can be
    viewed and changed on the settings page.
  • The | copilot and | splexplain search commands report errors in English when the
    command's lang= argument, the Copilot UI language, the Splunk user language or
    copilot.conf response_language is English.
  • Licensing: a /etc/machine-id file in a non-UTF-8 encoding no longer crashes host
    fingerprinting.
  • Installation guide: new section on running Splunk in Docker, including how to keep the
    license fingerprint stable across container restarts and re-creation.

Download and install

File Use it for
RST-Splunk-AI-Copilot-2.0.10-selfcontained.spl Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.10-fallback.spl Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256 SHA-256 checksums
release-manifest.token Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.10-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.10-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

Assets 7
Loading