Skip to content

v2.0.12

Choose a tag to compare

View all tags
@sooua sooua released this 06 Oct 11:17
· 4 commits to main since this release
v2.0.12
2d1b920
  • In-product EULA acceptance: every user accepts the current EULA in the app before
    first use, and again after each EULA version change, in every edition including
    Community. Until then the app's REST requests are refused. The | copilot and
    | splexplain search commands, the MCP server and background tasks are not affected.
    Accounts used only for direct REST calls must open the app once and accept.
  • EULA 1.4: acceptance wording for the in-app click-accept, more detail on the host
    fingerprint (including the locally generated host id), and the license service is
    hosted in the Hong Kong SAR.
  • Hosts first activated on 2.0.10 or earlier move to the current fingerprint binding
    about 5 minutes after the upgrade, without using an extra node. Offline licenses are
    not affected.
  • A host refused because the license's node limit is used up (for example an extra
    search head cluster member) now shows "License node limit reached" instead of
    "license server unreachable", and the License page warns as soon as the host is
    refused, before paid features stop at the end of the grace period.
  • Search head cluster licensing is no longer Beta. See INSTALL.md §4.1.
  • Scheduled report push now delivers: each report is pushed once per period to the
    notification targets bound to that period (before, it was never sent). Failed pushes
    are retried. Requires the reports entitlement.
  • New setting "Scheduled report language" (Settings > Reports); scheduled reports and
    their push cards follow it.
  • Switching the UI language re-renders the open report in the new language (preset
    periods; a custom range offers to regenerate).
  • License error reasons such as a clock rollback are shown in the UI language, and pages
    show the real error instead of a generic "Request failed".
  • English error messages from the search commands use English feature names.
  • INSTALL: Docker containers without a machine-id activate via a persisted host id
    (2.0.11 and later); a rolling restart may be needed after apply shcluster-bundle.

Download and install

File Use it for
RST-Splunk-AI-Copilot-2.0.12-selfcontained.spl Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.12-fallback.spl Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256 SHA-256 checksums
release-manifest.token Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.12-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.12-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

Assets 7
Loading