Skip to content

v2.0.14

Choose a tag to compare

View all tags
@sooua sooua released this 08 Oct 12:03
· 3 commits to main since this release
v2.0.14
761c256
  • Release packages are renamed to RST-AI-Copilot-for-Splunk-<version>-selfcontained.spl
    and -fallback.spl, and the GitHub repositories to Reallysec/RST-AI-Copilot-for-Splunk.
    The app id is unchanged, so license, data and settings carry over. The in-app update
    from 2.0.13 or earlier fails once: install this release from the Releases page via
    Apps > Manage Apps > Install app from file with "Upgrade app" checked; later updates
    work online again.
  • The selfcontained package supports Linux x86_64 only. On ARM (aarch64) hosts use the
    fallback package.
  • LLM failover is out of Beta. When the primary provider times out, refuses the
    connection or returns a server error, the request moves to the next provider, and the
    audit log records which provider served it. A hung provider now fails over after
    [llm] timeout_seconds instead of waiting for the whole agentic turn.
  • Trusted time for license checks uses HTTPS only; the UDP/NTP fallback is removed.
  • Ticketing: Jira Data Center is supported (personal access token); Jira Cloud tickets
    keep bold text and links; ServiceNow incidents no longer set non-default category and
    contact type values. Ticketing stays Beta.
  • Microsoft Teams: current Workflows webhook addresses (*.environment.api.powerplatform.com)
    are accepted. Webhook credentials no longer appear in delivery errors.
  • Update downloads that fail report the HTTP status or "update source unreachable"
    instead of an internal error.
  • License page: features that cannot run on this host are shown as locked, including on
    hosts without a readable hardware fingerprint, with a hint that names the cause; legacy
    licenses show "All features".
  • Scheduled report push: a target bound after a schedule was enabled no longer triggers
    a catch-up push; a hint shows when the push hour falls on the next local day; a
    hand-edited schedule no longer stops pushes.
  • | copilot and | splexplain errors use the user's language right after a Splunk
    restart.
  • The EULA dialog's language toggle switches the whole dialog.

Download and install

File Use it for
RST-AI-Copilot-for-Splunk-2.0.14-selfcontained.spl Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-AI-Copilot-for-Splunk-2.0.14-fallback.spl Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256 SHA-256 checksums
release-manifest.token Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-AI-Copilot-for-Splunk-2.0.14-selfcontained.spl.sha256
tar xzf RST-AI-Copilot-for-Splunk-2.0.14-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

Assets 7
Loading